This summer brought a new example of the security risks tied to artificial intelligence: researchers at the startup Hacktron AI used Anthropic’s Claude models to chain vulnerabilities and penetrate OpenAI systems.
According to The Wall Street Journal, Hacktron AI’s team discovered the issues under OpenAI’s bug bounty program and reported their findings to the company. OpenAI awarded the researchers $6,500 (about HUF 2,050,000) following the report.
How the intrusion worked
Hacktron AI’s researchers found an attack path on July 25 that led directly into OpenAI infrastructure. The initial entry point was a third-party component used to run OpenAI’s community forums (Discourse): a seemingly ordinary image-upload feature.
When users uploaded images in HEIF or HEIC formats (Apple’s formats), the Discourse stack converted them to JPEGs. The conversion first invoked ImageMagick, a long-used open-source tool for image processing, which then handed decoding to a library called libheif because ImageMagick could not handle those Apple formats.
A memory-management flaw in libheif allowed a maliciously crafted image to cause an incorrect calculation during decoding. That flaw was sufficient for attackers to execute code on the server and take control. Hacktron AI suggests the vulnerable libheif version remained in use within Discourse because, although the libheif developers had fixed the bug months earlier, they did not assign a CVE identifier — a common industry practice for tracking vulnerabilities and fixes.
The role of AI models: Opus 4.8 vs Opus 5
The researchers reported that Anthropic’s Opus 4.8 Claude model, which had been adapted for cybersecurity tasks, initially could not produce a working exploit. After the release of Opus 5, however, the model was able almost immediately to find a solution that assisted the exploit development.
Once on the Discourse server, the researchers discovered an additional vulnerability that allowed them to take over ChatGPT and Codex accounts, including those belonging to OpenAI employees. Hacktron AI notified OpenAI and Discourse of the issues; OpenAI says it deployed a fix on July 27.
Why this matters
The incident highlights several points: small bugs in third-party components can escalate into significant system compromises; AI-model updates can rapidly change attackers’ capabilities, as shown by the difference between Opus 4.8 and Opus 5; and the absence of standardized vulnerability tracking (CVE tags) can prolong exposure.
Matt Fredrikson, CEO of Gray Swan AI security firm, emphasized that if an organization likely investing heavily in cybersecurity such as OpenAI can be affected, similar risks exist elsewhere. The case underlines the need for continuous risk management, transparent vulnerability tracking, and prompt remediation when dealing with AI-driven development and third-party software components.
