# Claude hacked into OpenAI in bug bounty test

> Security researchers used Anthropic's AI to break into OpenAI, exposing how accessible hacking tools have become.
- Title: Claude hacked into OpenAI in bug bounty test · TechCrunch
- Summary: Security researchers used Anthropic's AI to break into OpenAI, exposing how accessible hacking tools have become. AI models are now powerful enough to find…
- Keywords: anthropic, openai, claude, cybersecurity, ai security, bug bounty, hacktron ai, vulnerability, discourse, exploit, ai capabilities, technology
- Source: TechCrunch — https://techcrunch.com/2026/09/18/researchers-used-anthropics-claude-to-hack-into-openai
- Author: Aditya Mehta, Rebecca Bellan
- Published: 2026-09-18T14:00:14+00:00
- Read time: 2 min
- Topics: anthropic, openai, claude, cybersecurity, ai security, bug bounty, hacktron ai, vulnerability, discourse, exploit, ai capabilities, technology
## Claude breaks into OpenAI
Security researchers at Hacktron AI used Anthropic's Claude to hack into OpenAI as part of a bug bounty program, gaining access to employee ChatGPT accounts.
## Two critical vulnerabilities chained
The researchers chained together two critical flaws to gain access to OpenAI's systems. OpenAI has since resolved both issues.
## Entry point was an image upload
The hack started July 25 through a flaw in Discourse, OpenAI's community forum software. Users uploading iPhone photos triggered a chain of image conversion tools that exposed a memory bug.
## ImageMagick and libheif chain
When iPhone HEIF images were uploaded, Discourse used ImageMagick to convert them, which then handed off to libheif. A memory bug in libheif let attackers inject their own instructions.
## Bug was already fixed months prior
The libheif vulnerability had been patched months earlier by developers, but the fix was never formally registered as a CVE, so Discourse didn't know to update.
## Opus 5 succeeded where 4.8 failed
Claude Opus 4.8 couldn't build a working exploit across multiple attempts. Within hours of Anthropic releasing Opus 5, the researchers gave it the same problem and it succeeded.

> Opus 4.8 struggled across several sessions to produce a working exploit. Within hours of Opus 5's release, we gave it the same problem and it succeeded.
## AI is democratizing exploit development
For two hundred dollars a month, anyone can access these tools and hack into major companies. Work that once took months can now take days.

> For $200 a month, anyone can use these tools and hack into a company like OpenAI.
## Open models catching up to frontier
Chinese company Z.ai's GLM-5.2 is only a few months behind OpenAI's GPT-5.5 and Anthropic's Claude in cyber capabilities, showing open-weight models are closing the gap.
## Restrictions lag behind capabilities
Claude Opus 5 hasn't faced export restrictions, unlike the newer Mythos 5 model. This highlights the challenge of controlling AI capabilities as they advance.
## Key takeaway

AI models are now powerful enough to find and exploit security vulnerabilities that would have taken human experts months to discover.