Security Researchers Used Anthropic’s Claude to Hack Into OpenAI’s Systems
Hacktron AI’s three-person team chained an unpatched libheif memory bug in Discourse with a second flaw to access OpenAI employee accounts and an internal GitHub repository on July 25. OpenAI paid $6,500; Discourse patched the issue July 27.
A three-person team of independent security researchers used Anthropic’s AI model Claude to break into OpenAI’s systems in July 2026, gaining access to employee accounts and an internal code repository before reporting the flaws to the company.
The team, from startup Hacktron AI, carried out the attack on July 25 as part of OpenAI’s bug-bounty program. They chained together two critical vulnerabilities — the first discovered in Discourse, the third-party software powering OpenAI’s community forum, and the second exploited once inside that server. OpenAI awarded Hacktron $6,500 for the findings and says it has since resolved the issues. Discourse issued a fix on July 27.
The initial entry point was an image upload flaw. When users posted HEIF or HEIC image files to OpenAI’s forum, Discourse routed them through a conversion pipeline that included a library called libheif. A memory bug buried in libheif allowed a specially crafted image to hijack the server. The bug had already been patched by libheif’s developers, but because the fix was never formally flagged as a vulnerability — meaning it received no CVE number — the version running on Discourse’s software remained unpatched.
Once inside the Discourse server, the researchers found a second flaw that allowed them to take over ChatGPT and Codex accounts belonging to OpenAI employees. “We then took over an OpenAI employee’s account, whose Codex was connected to OpenAI’s Github organization,” Hacktron wrote in a blog post.
The researchers initially used a special cybersecurity version of Anthropic’s Opus 4.8, which failed to produce a working exploit. The breakthrough came when Anthropic released Opus 5. “Within hours of Opus 5’s release, we gave it the same problem and it succeeded,” Hacktron wrote.
The incident underscores how accessible AI tools may be lowering the barrier to sophisticated cyberattacks. “For $200 a month, anyone can use these tools and hack into a company like OpenAI,” Matt Fredrikson, CEO of AI security firm Gray Swan, told TechCrunch. Hacktron founder Mohan Pedhapati noted on X: “AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days.”