Claude breaks into OpenAI

Security researchers at Hacktron AI used Anthropic's Claude to hack into OpenAI as part of a bug bounty program, gaining access to employee ChatGPT accounts.

Two critical vulnerabilities chained

The researchers chained together two critical flaws to gain access to OpenAI's systems. OpenAI has since resolved both issues.

Entry point was an image upload

The hack started July 25 through a flaw in Discourse, OpenAI's community forum software. Users uploading iPhone photos triggered a chain of image conversion tools that exposed a memory bug.

ImageMagick and libheif chain

When iPhone HEIF images were uploaded, Discourse used ImageMagick to convert them, which then handed off to libheif. A memory bug in libheif let attackers inject their own instructions.

Bug was already fixed months prior

The libheif vulnerability had been patched months earlier by developers, but the fix was never formally registered as a CVE, so Discourse didn't know to update.

Opus 5 succeeded where 4.8 failed

Claude Opus 4.8 couldn't build a working exploit across multiple attempts. Within hours of Anthropic releasing Opus 5, the researchers gave it the same problem and it succeeded.

“Opus 4.8 struggled across several sessions to produce a working exploit. Within hours of Opus 5's release, we gave it the same problem and it succeeded.”

AI is democratizing exploit development

For two hundred dollars a month, anyone can access these tools and hack into major companies. Work that once took months can now take days.

“For $200 a month, anyone can use these tools and hack into a company like OpenAI.”

Open models catching up to frontier

Chinese company Z.ai's GLM-5.2 is only a few months behind OpenAI's GPT-5.5 and Anthropic's Claude in cyber capabilities, showing open-weight models are closing the gap.

Restrictions lag behind capabilities

Claude Opus 5 hasn't faced export restrictions, unlike the newer Mythos 5 model. This highlights the challenge of controlling AI capabilities as they advance.