A three-person security team at startup Hacktron AI used Anthropic’s Claude model to break into OpenAI’s internal systems in under 72 hours, exploiting a chain of vulnerabilities that ultimately gave them access to employee ChatGPT and Codex accounts, along with GitHub organization credentials, all through OpenAI’s own bug-bounty program.
The breach, disclosed publicly on September 18, has drawn attention less for the vulnerabilities themselves than for how the researchers found them: by handing the problem to Claude and letting the AI model do much of the exploit development work.
How the researchers got in
The attack chain started on July 25 with a flaw in the Discourse software that powers OpenAI’s community forum, specifically in how the platform handled image uploads. When users uploaded photos in Apple’s HEIF/HEIC format, the forum triggered a conversion process using ImageMagick and the libheif library. Buried in that conversion pipeline was a memory bug: a miscalculation in how libheif handled image positioning data, which the researchers found could be exploited to hijack the server processing the upload.
From a forum bug to account takeover
Getting into the forum’s server was only the first step. The researchers identified a second vulnerability that let them pivot from that initial foothold into compromising OpenAI employee accounts on ChatGPT and Codex, OpenAI’s coding-focused AI tool. From there, they gained access to GitHub organization credentials, effectively giving them a path from a single image-upload bug on a community forum to serious internal access at one of the world’s most closely watched AI companies.
Why Claude was the story
What makes the case notable isn’t just the vulnerability chain — bug chains like this one get found and reported through bug-bounty programs regularly — it’s that the researchers leaned on Claude to build the working exploit rather than writing it entirely by hand. According to the Hacktron team, Anthropic’s older Opus 4.8 model struggled to put together a functional exploit for the vulnerability chain. But once Anthropic released its newer Opus 5 model, the team said, “Within hours of Opus 5’s release, we gave it the same problem and it succeeded,” turning a bug that had resisted an earlier AI model into a working exploit almost immediately after a model upgrade.
What OpenAI did about it
OpenAI’s Discourse forum software received a fix on July 27, just two days after the initial vulnerability was found, and the company confirmed it has resolved the identified issues. Through its bug-bounty program, OpenAI paid the Hacktron researchers $6,500 for the discovery and responsible disclosure, a payout that reflects standard bug-bounty practice even though the chain of vulnerabilities ultimately reached deep into the company’s internal systems.
The bigger concern security experts are raising
The case has become a talking point in AI security circles less because of the specific bug and more because of what it demonstrates about accessibility. Matt Fredrikson, CEO of AI security firm Gray Swan, put it bluntly: “For $200 a month, anyone can use these tools and hack into a company like OpenAI.” His comment captures the core worry driving reaction to the disclosure: that increasingly capable AI models are lowering the skill and resource threshold required to develop working exploits for serious vulnerabilities, potentially putting sophisticated hacking capability within reach of far more people than before.
What this means for AI-assisted security research
The Hacktron case sits at an awkward intersection for the AI industry: the same capability that let ethical researchers responsibly disclose a serious vulnerability chain to OpenAI is, in principle, available to anyone willing to pay for access to a frontier AI model, whether their intentions are defensive or malicious. Security researchers have increasingly flagged that as AI models grow more capable at tasks like vulnerability discovery and exploit development, the gap between what a well-funded, technically sophisticated attacker can do and what a much less skilled but AI-assisted attacker can do continues to narrow, a dynamic this case illustrates about as directly as any recent example.
How this fits a broader pattern
This disclosure follows a string of recent incidents in which AI models have been shown capable of autonomously or semi-autonomously finding and exploiting real vulnerabilities, including cases involving other major labs’ models conducting unauthorized intrusions during testing. Taken together, security researchers say these incidents point to a fast-moving shift in offensive cybersecurity capability, one where AI labs’ own model releases — in this case, the jump from Opus 4.8 to Opus 5 — can directly determine whether a previously unexploitable bug suddenly becomes usable, sometimes within hours of a new model becoming available.
What companies should take from this
For companies running bug-bounty programs, the Hacktron disclosure is likely to accelerate an already-growing conversation about how quickly newly discovered vulnerabilities need to be patched once AI tools make exploit development faster, and whether traditional bug-bounty timelines and payouts are keeping pace with how much easier serious exploits have become to build. OpenAI’s two-day turnaround on the initial Discourse fix suggests at least some companies are already treating AI-accelerated vulnerability discovery as reason to move faster than they might have in the past.
How Anthropic has responded
Anthropic has not publicly detailed specific safeguards tied to this particular incident, though the company has previously said it monitors for misuse of Claude and has taken action in the past to disrupt attempts to use its models for cybercrime. The Hacktron case complicates that picture somewhat, since the researchers’ use of Claude was authorized, disclosed responsibly and aimed at a legitimate bug-bounty target — the kind of use case AI labs generally want to encourage — even as it demonstrates the same underlying capability that could, in different hands, be pointed at unauthorized targets instead.
Follow Smashology Media’s Tech coverage for more on how AI models are reshaping cybersecurity.
Sources
- TechCrunch: Researchers used Anthropic’s Claude to hack into OpenAI
- CBS News: AI security experts say they used Claude to hack ChatGPT
Leon Ramoviq
Primary Author · Editorial Reviewer · Researcher Leon Ramoviq is a digital media researcher, content creator, and primary author at Smashology Media. His work focuses on researching, verifying, and developing stories across entertainment, culture, sports, internet trends, curiosity-driven topics, and viral news. Before publishing, Leon reviews sources, cross-checks key claims, and works to ensure that articles are clear, accurately represented, and based on reliable information rather than unverified social-media speculation. With experience in digital media, graphic design, social media content, and online audience engagement, he brings both an editorial and visual perspective to the stories published on Smashology. Leon is particularly interested in how stories spread online, why certain topics capture public attention, and how complex or trending information can be presented in a simple and engaging format. Role at Smashology As a primary author and researcher, Leon is involved in: • Researching stories and identifying original or reliable sources • Writing and developing articles for Smashology • Reviewing facts, names, dates, quotations, and contextual information • Checking stories for misleading or unsupported claims • Reviewing articles before publication • Following developments and updating stories when meaningful new information becomes available • Maintaining editorial consistency across Smashology content Editorial Approach Leon believes engaging content should not come at the expense of accuracy. His approach is to combine strong storytelling with responsible sourcing, clear attribution, and additional verification when a story originates from social media or rapidly developing online discussions.
