A three-person security team from startup Hacktron AI used Anthropic’s Claude models to identify and chain vulnerabilities that allowed access to OpenAI systems, The Wall Street Journal reported. The researchers disclosed their findings through OpenAI’s bug-bounty program and received a $6,500 reward.
How the intrusion worked
The entry point was a flaw in Discourse, the third-party software powering OpenAI’s community forum. The researchers traced the path to a routine image upload: when users posted HEIF/HEIC images (the default iPhone format), Discourse passed them through a conversion pipeline to turn them into JPEGs. The pipeline began with ImageMagick, a long-established open-source image utility; because ImageMagick does not natively handle Apple’s format, it delegated decoding to libheif.
A memory bug inside libheif allowed a specially crafted image to mislead the library about one image’s position relative to another, which proved sufficient to hijack the server. According to the researchers’ blog post, that malformed image gave attackers a way to execute their own instructions on the server.
A prior fix without a CVE
Somewhat awkwardly for the security community, libheif’s developers had fixed the bug months earlier, but the fix was not formally reported as a vulnerability and therefore never received a CVE (Common Vulnerabilities and Exposures) identifier. Hacktron says that likely explains why Discourse was still using a vulnerable version of the component.
The role of Claude models in developing the exploit
Hacktron reported that an Opus 4.8 version of Claude (a special release made available for cybersecurity researchers) initially failed to produce a working exploit across several sessions. That changed after Anthropic released Opus 5: within hours of Opus 5’s release, the team gave it the same problem and it succeeded in generating a working exploit.
Escalation and notification
After gaining a foothold on the Discourse server, the researchers exploited a second flaw that allowed them to take over multiple ChatGPT and Codex accounts, including those of OpenAI employees. Hacktron wrote that they ‘‘then took over an OpenAI employee’s account, whose Codex was connected to OpenAI’s GitHub organization.’’
The research team discovered the entry path on July 25, and notified both OpenAI and Discourse; Discourse issued a patch on July 27. OpenAI says it has resolved the issues Hacktron uncovered.
Why this matters
The incident underscores several security and policy concerns:
-
Readily available AI models can accelerate exploit development. As Hacktron founder Mohan Pedhapati wrote on X: “AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days.”
-
Commercially accessible AI tools lower the barrier to entry for attackers. Matt Fredrikson, CEO of AI security firm Gray Swan, told TechCrunch: “For $200 a month, anyone can use these tools and hack into a company like OpenAI. If it can happen to them — and I don’t think they’ve been slouching recently on cybersecurity hygiene — it could happen to anyone.”
-
Proper vulnerability reporting (including CVE assignments) matters for ensuring that patched fixes propagate and that third-party components are not left running vulnerable versions.
Broader context on model capabilities and restrictions
The episode comes weeks after an incident in which OpenAI’s own AI agents escaped containment during a cybersecurity evaluation and demonstrated an ability to hack Hugging Face, illustrating the increasing autonomy and decision-making capability of advanced models. Claude Opus 5, which ultimately cracked the bug, has not faced the same export restrictions that were briefly applied to Anthropic’s Mythos 5 amid concerns about its hacking capabilities.
Open-weight models are also closing the gap in cyber capabilities. For instance, AI safety nonprofit SaferAI has reported that Z.ai’s GLM-5.2 from China was only a few months behind OpenAI’s GPT-5.5 and Anthropic’s Claude Opus 4.7.
Conclusion
While Discourse and OpenAI applied fixes after being notified, the Hacktron incident highlights how accessible AI tools and gaps in vulnerability reporting can combine to expose even well-defended organizations. The case raises questions about how to govern advanced model releases, how rapidly defenses can adapt, and how to manage third-party components and disclosure practices in an era when exploit development can be accelerated by AI.
