Security researchers used Anthropic's Claude to hack OpenAI's internal systems in under 72 hours
Hacktron researchers used Claude Opus 5 to exploit libheif and an SSO flaw, taking over OpenAI employee ChatGPT and Codex accounts within 72 hours.
Three Hacktron researchers chained a libheif image-parsing flaw in OpenAI's Discourse-hosted community forum with an SSO misconfiguration to hijack employee ChatGPT and Codex accounts, then opened a harmless pull request in OpenAI's internal monorepo as proof of impact. Claude Opus 4.8 could only build the exploit with ASLR disabled; Claude Opus 5 produced a working exploit within hours of its July 24 release. OpenAI patched roughly 14 hours after the report, and the broader HEIF Heist project covered Slack, Meta, and GitHub Enterprise for under $3,000 in AI spend. The researchers argue AI has made reliable exploit development drastically cheaper.
- Attack chained a libheif image-parsing flaw with an OpenAI SSO misconfiguration
- Claude Opus 5 produced a reliable ASLR-enabled exploit where Opus 4.8 failed
- Researchers proved access by opening a pull request in OpenAI's internal monorepo
- HEIF Heist spent under $3,000 on AI across two months of testing
- Only Shopify noticed the activity despite thousands of image uploads
- Victims
- OpenAI
- AI models
- Claude Opus 5Claude Opus 4.8
From the original article
3 min read at the-decoder.com
Three security researchers used Anthropic's Claude models to break into OpenAI's internal systems through its community forum in less than 72 hours. According to the team, Opus 5 succeeded where its predecessor couldn't bypass a common security measure. The attack shows how newer AI models can cut the time and expertise needed to exploit security flaws.
By Matthias Bastian · the-decoder.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.