Researchers used Anthropic’s Claude to hack into OpenAI
Researchers used Claude Opus 5 to chain libheif and Discourse flaws, hijacking OpenAI employee ChatGPT and Codex accounts via bug bounty.
A three-person team at startup Hacktron AI chained a libheif memory bug (reached via crafted HEIF/HEIC uploads through Discourse's ImageMagick pipeline, never assigned a CVE) with an account-takeover flaw to access OpenAI employee ChatGPT and Codex accounts, one linked to OpenAI's GitHub organization. OpenAI paid a $6,500 bug bounty and says the issues are resolved; Discourse shipped a fix on July 27 after disclosure. Claude Opus 4.8 failed to produce a working exploit across several sessions, but Opus 5 succeeded within hours of release, underscoring how AI is collapsing the expertise needed to develop exploits.
- Entry via crafted HEIF/HEIC image uploads triggering a libheif memory bug in Discourse's image pipeline
- The libheif fix was never assigned a CVE, so Discourse ran a vulnerable version
- Second flaw enabled takeover of employee ChatGPT/Codex accounts, one tied to OpenAI's GitHub org
- Claude Opus 5 built a working exploit within hours where Opus 4.8 failed across sessions
- OpenAI paid a $6,500 bug bounty and says both issues are now resolved
- Victims
- OpenAI
- Organizations
- Hacktron AIImageMagicklibheif
- AI models
- Claude Opus 5Claude Opus 4.8
From the original article
4 min read at techcrunch.com
Security researchers used Anthropic’s Claude to exploit vulnerabilities in OpenAI’s systems, taking over employee accounts and gaining access to an internal code repository before reporting the flaws.
By Aditya Mehta, Rebecca Bellan · techcrunch.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.