Security researchers used Anthropic’s Claude to help breach OpenAI’s systems, gaining access to employee ChatGPT and Codex accounts and demonstrating a path into an internal OpenAI software repository.
The research was conducted by Hacktron AI as part of security testing and responsible disclosure. The team linked vulnerabilities in OpenAI’s community forum and its sign-in system, turning an issue in a third-party service into access to OpenAI employee sessions.
Claude Helped Build the Exploit
Hacktron began investigating the image-upload pipeline of OpenAI’s community forum, which runs on Discourse. The researchers found a vulnerability involving the libheif image-decoding library that could be triggered through specially crafted HEIF images.
Claude was used to help analyze the vulnerability and develop an exploit. The researchers said an earlier Claude model struggled to produce a reliable version that worked with modern memory protections. After Claude Opus 5 became available, the team said it produced a working ARM64 exploit within hours, which they then adapted to the environment used by the forum.
The Attack Reached Employee Accounts
After gaining control of the forum environment, the researchers identified a separate problem in OpenAI’s sign-in flow. The combination allowed them to take over active ChatGPT and Codex sessions belonging to OpenAI employees.
One compromised Codex account was connected to OpenAI’s private GitHub organization. Rather than reading confidential source code, the researchers used the access to create a harmless pull request in an internal repository as proof that the attack path worked.
The complete chain from the initial discovery to demonstrated repository access took less than 72 hours, according to Hacktron.
OpenAI Fixed the Vulnerability
Hacktron reported the OpenAI-side issue through the company’s bug bounty program and stopped testing after demonstrating the impact. OpenAI said it narrowed permissions on community sign-in tokens and revoked affected tokens and sessions.
The company awarded Hacktron a $6,500 bounty for the OpenAI-side security finding. The underlying image-processing vulnerability was also reported to Discourse, which later released fixes and additional isolation for image processing.
AI Is Becoming Part of the Cybersecurity Battle
The incident is another example of how advanced AI models can assist legitimate security researchers with technically difficult work. It also shows why protecting an AI company involves more than securing the model itself. Authentication systems, third-party software, developer tools and connected accounts can all become part of the security boundary.
The episode follows growing evidence that AI is becoming more capable across the cybersecurity field. Our report on AI cyberattacks examines how increasingly capable models could help automate parts of offensive and defensive security work.
It also comes as AI companies face increasing concerns about misuse. We recently covered Claude misuse in a separate case involving the use of Anthropic’s model for dangerous technical work.
The OpenAI incident does not mean the ChatGPT model itself was directly hacked. Instead, researchers exploited weaknesses around OpenAI’s infrastructure and identity systems to reach employee accounts and connected services. That distinction matters as companies increasingly connect AI assistants to sensitive tools and internal systems.
As AI systems become more capable, the same technology can increasingly be used by both attackers and defenders. The security challenge will be keeping authentication, software dependencies and connected AI tools secure as those capabilities continue to advance.
