Security researchers used Anthropic's Claude to hack OpenAI

Independent security researchers used Anthropic’s Claude to break into OpenAI, exposing cracks in the ChatGPT maker’s defenses, The Wall Street Journal reported Thursday evening. A three-person security team at startup Hacktron AI carried out the attack as part of an OpenAI bug-bounty program, reported its findings, and received a $6,500 award. The team chained together two critical vulnerabilities to gain access to multiple OpenAI employee ChatGPT accounts, giving them entry into the company’s software. OpenAI says it has resolved the issues Hacktron uncovered.

The researchers found their way in on July 25 through a flaw in Discourse, the third-party software that powers OpenAI’s community forum. The entry point, per their blog post, was a mundane image upload: when users posted HEIF or HEIC files — the format iPhones use by default — Discourse converted them to JPEGs by routing them through ImageMagick, which handed off decoding to a library called libheif. A memory bug in libheif let a specially crafted image miscalculate how one image was positioned over another, enough to hijack the server. The bug had already been fixed months earlier by libheif’s developers, but the fix was never flagged as a vulnerability and never got a CVE number — which Hacktron says may explain why Discourse was still running the vulnerable version.

Once inside the Discourse server, the researchers found another flaw that let them take over users’ ChatGPT and Codex accounts, including those of OpenAI employees — Hacktron wrote that it took over one employee’s account whose Codex was connected to OpenAI’s GitHub organization. The researchers alerted OpenAI and Discourse, which issued a fix on July 27.

Notably, the Claude model the researchers first used — a special version of Opus 4.8 made available for cybersecurity researchers — couldn’t build a working exploit at first. That changed once Anthropic released Opus 5. “Opus 4.8 struggled across several sessions to produce a working exploit,” Hacktron wrote in its blog post. “Within hours of Opus 5’s release, we gave it the same problem and it succeeded.” Opus 5 hasn’t faced security export restrictions, unlike the newer Mythos 5, which was temporarily locked down over concerns about its hacking capabilities. Open-weight models are catching up too: AI safety nonprofit SaferAI recently found that Chinese company Z.ai’s GLM-5.2 was only a few months behind OpenAI’s GPT-5.5 and Anthropic’s Claude Opus 4.7.

Why it matters

The incident shows how quickly frontier AI models are lowering the technical bar for building working exploits — turning capability jumps between model releases into a security variable labs and enterprises now have to track.