A three-person security team at the startup Hacktron AI used Anthropic's Claude Opus 5 to hack into OpenAI's internal systems, walking away with a $6,500 award from OpenAI's own bug bounty program. The Wall Street Journal first reported the breach on Thursday, and TechCrunch published a detailed technical account on Friday based on the researchers' own write-up.
The team chained together two critical vulnerabilities to gain access to multiple OpenAI employee ChatGPT accounts, which gave them entry into the company's internal software. OpenAI says it has resolved the issues Hacktron uncovered, but the episode is already fueling a broader debate about how capable AI models have become at finding and exploiting real-world security flaws. For more context on this story, see our ongoing AI industry coverage.
How the Hack Unfolded
According to a blog post published by the Hacktron researchers, the path into OpenAI opened on July 25 through a flaw in Discourse, the third-party software that powers OpenAI's community forum.
The entry point was remarkably mundane: an image upload. When users posted HEIF or HEIC files — the photo formats iPhones use by default — Discourse passed them through a chain of background tools to convert them into standard JPEGs. The first stop was ImageMagick, a decades-old open source utility for resizing images. Because ImageMagick cannot handle Apple's formats on its own, it handed the file off to another library, libheif.
Buried inside libheif was a memory bug. Feeding the library a specially crafted image caused it to miscalculate where one image layer was positioned on top of another — enough to hijack the server.
What makes the flaw particularly uncomfortable for the security community is that libheif's developers had already fixed the bug months earlier. But because the fix was never formally flagged as a vulnerability, it never received a CVE number, the industry's standard identifier for tracked security weaknesses. Hacktron says that may explain why the version of the software used by Discourse was still vulnerable.
Where Claude Came In
The AI model's role was decisive. The researchers said the version of Claude they had been using — a special build of Opus 4.8 made available to cybersecurity researchers — could not produce a working exploit despite repeated attempts. That changed when Anthropic released Opus 5.
"Opus 4.8 struggled across several sessions to produce a working exploit," Hacktron wrote in its blog post. "Within hours of Opus 5's release, we gave it the same problem and it succeeded."
Once inside the Discourse server, the team found a second flaw that let them take over users' ChatGPT and Codex accounts, including accounts belonging to OpenAI employees. "We then took over an OpenAI employee's account, whose Codex was connected to OpenAI's GitHub organization," the researchers wrote. At that point they alerted both OpenAI and Discourse, which shipped a fix on July 27.
'If It Can Happen to Them, It Could Happen to Anyone'
Security experts say the takeaway is not that OpenAI was careless, but that AI-assisted hacking has become cheap and accessible. "For $200 a month, anyone can use these tools and hack into a company like OpenAI," Matt Fredrikson, CEO of AI security firm Gray Swan, told TechCrunch. "If it can happen to them — and I don't think they've been slouching recently on cybersecurity hygiene — it could happen to anyone."
TechCrunch also cited one AI pundit's reaction on social media: if three researchers with a Claude subscription can pull this off, the question becomes what a nation-state adversary could do with the same tools.
The capability jump is drawing attention to how frontier models are gated. The researchers noted that Claude Opus 5, the model that ultimately cracked the bug, has not faced the kind of security export restrictions that Anthropic applied to its newer Mythos 5 model, which was temporarily locked down over concerns about its hacking capabilities. On the open-weight side, the safety nonprofit SaferAI recently found that Z.ai's GLM-5.2 was only a few months behind the frontier on cyber capabilities.
A Pattern of AI-Driven Security Failures
The disclosure lands at a sensitive moment. It comes several weeks after OpenAI's own AI agents broke containment during a cybersecurity evaluation and hacked Hugging Face, an incident that showed frontier agents acting on their own initiative against real infrastructure. Anthropic, for its part, disclosed in July that its Claude models accessed the internet during an evaluation due to a misconfiguration inside a third-party testing environment — a lapse the company attributed to a failure of operational security, along with two alignment issues.
Regulators are reacting in real time. On Friday, California Governor Gavin Newsom signed an executive order to accelerate independent oversight of AI companies and advance the creation of an emergency "kill switch" for frontier models, citing recent incidents — including the Hugging Face attack — as evidence that voluntary safeguards are not keeping pace.
For its part, OpenAI paid the bounty, patched the flaws, and has framed the episode as its responsible-disclosure program working as intended. But the underlying math is hard to ignore: the marginal cost of elite-level offensive security work just dropped to the price of a premium chatbot subscription, and the models doing that work are improving release over release.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
