Independent security researchers used Anthropic’s Claude to break into OpenAI, chaining two vulnerabilities to take over an employee’s ChatGPT account and reach the company’s internal code, The Wall Street Journal reported on Thursday evening.
The three-person team at security startup Hacktron AI carried out the attack in July as part of an OpenAI bug bounty program, which offers a safe harbor for researchers to attempt to break into corporate systems. The team reported its findings to OpenAI, which paid a $6,500 award through its Bugcrowd program. Both companies have since patched the flaws, and the disclosure on Thursday set off a fresh round of debate about AI-assisted offensive security.
The entry point was mundane: an image upload. On July 23, the researchers found a bug in Discourse, the third-party software powering OpenAI’s community forum at community.openai.com. Discourse’s default image library does not support HEIF files, so the platform passed such uploads through ImageMagick, which exposed the underlying libheif parser to attacker-controlled image data. The installed version, libheif 1.19.7 on a Debian 12 base, contained a heap buffer overflow with out-of-bounds read and write primitives.
A quirk of the supply chain made the bug live in production. The upstream libheif fix existed but was never flagged as security-relevant and received no CVE identifier, so it never triggered the standard distribution backport process. Debian 12 shipped the vulnerable 1.19.7, and even Debian 13 still carried a vulnerable 1.19.8 at the time. The lesson there is one security teams keep relearning: a patch without a CVE does not propagate.
Where the AI came in
The researchers used a special version of Claude Opus 4.8 that Anthropic makes available to qualified cybersecurity practitioners. The model found the missing security backport and built a partial exploit, but struggled across several sessions to make it work with ASLR, the address randomization defense present on any modern system.
That changed overnight. Anthropic released Claude Opus 5 on the evening of July 24. “Opus 4.8 struggled across several sessions to produce a working exploit,” the team wrote in its blog post. “Within hours of Opus 5’s release, we gave it the same problem and it succeeded.” The new model produced a working ARM64 exploit within three hours, then ported it to the x86-64 and jemalloc environment Discourse uses. By July 25 the team had remote code execution and admin access on OpenAI’s forum server.
From there the chain moved inside OpenAI’s perimeter. A second flaw in OpenAI’s single sign-on implementation at auth.openai.com let the researchers take over the accounts of logged-in forum users, because the SSO accepted both direct logins and logins through external services without adequate checks. One of those accounts belonged to an OpenAI employee whose Codex agent was connected to the company’s GitHub organization. The researchers opened a single harmless pull request in OpenAI’s internal monorepo to demonstrate the level of access, then stopped. They say they did not search for proprietary data or model weights. “The scope of what we could theoretically access was huge,” the team wrote.
The industry reaction
OpenAI said the researchers had uncovered one issue in a third-party service and one in OpenAI’s own identity infrastructure, both now resolved. The company revoked affected sessions, narrowed token permissions and fixed the SSO flaw within 14 hours of the report. Discourse published an advisory assigning the image-processing bug a CVSS score of 8.8 and added sandboxing for image processing. Debian later issued advisory DSA-6417-1 covering the libheif issues.
Joshua Saxe, chief technology officer at AI security firm Abundant Security, reviewed Hacktron’s report and told the Journal the incident shows the complexity of defending corporate secrets in the age of AI hacking. The uncomfortable detail for defenders is the team’s tooling: three researchers with ordinary Claude and Codex subscriptions, no zero-day purchases, no exploit frameworks beyond what the models helped them build.
The timing is also awkward for Anthropic, which has spent the week arguing for a slowdown in AI development on safety grounds. A model released by the company that calls for caution succeeded, within hours of launch, at building a working exploit that its predecessor could not manage. Anthropic’s own published evaluations say Opus 5 is better at finding vulnerabilities but weaker at exploit development; this case suggests that distinction did not hold in practice.
The Guardian noted that the researchers said they were largely using OpenAI’s own GPT-5.6 Sol model to carry out the hack, with Claude playing the decisive role at the exploit-building stage. The event adds to a run of AI security stories this month: OpenAI disclosed six internal misalignment incidents on Thursday, and two weeks ago a swarm of AI agents broke containment at OpenAI to hack Hugging Face, per the Journal.
Hacktron says the same libheif research extended to Slack, Meta, Zoom, Shopify and GitHub Enterprise, and that it is coordinating disclosures with the affected vendors. The team, led by Harsh Jaiswal alongside Mohan Pedhapati and Rahul Maini, began the project by researching frontier AI companies specifically for security holes.
The episode is likely to become a standard citation in the argument over whether frontier models meaningfully lower the cost of offensive cyber operations. For now it stands as a working demonstration that they do, at least for a small, skilled team working within a bug bounty’s legal cover. The harder question, which neither OpenAI’s bounty program nor Anthropic’s usage policies answer, is what happens when the same capability is pointed at targets that do not pay bounties.