Key facts
- Independent security researchers used Anthropic's Claude AI models to breach OpenAI's security.
- The Hacktron AI team chained together two critical vulnerabilities to gain access to employee ChatGPT accounts and internal software.
- The exploit leveraged a memory bug in the libheif library, which had been previously fixed but not assigned a CVE.
- Anthropic's Claude Opus 5 model was instrumental in developing the working exploit.
- OpenAI confirmed the incident, patched the vulnerabilities within 14 hours, and awarded Hacktron AI a $6,500 bounty.
- The incident highlights how AI models are reducing the expertise needed to develop exploits.
Independent security researchers used Anthropic's Claude AI models to breach OpenAI's security, gaining access to internal code and employee accounts. The Hacktron AI team exploited a flaw in the Discourse software powering OpenAI's community forum, specifically a memory bug within the libheif library used for image conversion. This bug had been previously fixed but lacked a CVE identifier, potentially explaining its continued presence in the vulnerable version.
The researchers found that Claude Opus 5 was crucial in developing a working exploit, succeeding where an earlier version, Opus 4.8, had struggled. Once inside the Discourse server, they exploited another flaw to take over users' ChatGPT and Codex accounts, including those belonging to OpenAI employees, which provided access to the company's GitHub organization.
OpenAI confirmed the incident, stating that the vulnerabilities were resolved within approximately 14 hours and that Hacktron AI was awarded a $6,500 bounty as part of its bug bounty program. The incident underscores concerns about the increasing capability of AI models to aid in sophisticated cyberattacks and highlights the potential for off-the-shelf AI tools to be used against even advanced infrastructure.