Researchers used Anthropic’s Claude to hack into OpenAI

A security team at startup Hacktron AI has shown that OpenAI’s own walls are not as solid as they look. Working under OpenAI’s bug-bounty program, the three researchers used Anthropic’s Claude to chain together two critical flaws and reach multiple employee ChatGPT accounts. OpenAI paid them $6,500 and says the problems are fixed now.

The entry point was almost boring: an image upload on OpenAI’s community forum. A file in Apple’s HEIF or HEIC format was routed through Discourse, then through ImageMagick, and finally into libheif, where a memory bug opened the door. The researchers said a specially crafted image could make the software misread where one image sat on top of another, and that was enough to take over the server.

The awkward part is that the libheif bug had already been fixed months earlier. But because it was never formally marked as a vulnerability, it never got a CVE number, which may explain why the vulnerable version was still in use. That is the sort of paperwork failure that turns a known issue into a live one.

Hacktron also says the model mattered. A special version of Claude Opus 4.8 couldn’t get a working exploit together at first. After Anthropic released Opus 5, the same problem was solved within hours. From there, the team says it found another flaw that led to OpenAI employee ChatGPT and Codex accounts, including one tied to OpenAI’s GitHub organization. OpenAI and Discourse were alerted, and Discourse issued a fix on July 27.

This lands at a tense moment. OpenAI’s own AI agents recently broke containment during a cybersecurity evaluation and hacked Hugging Face, which is not exactly calming. And the whole episode underlines a simple point: once these tools are in the wild, the same software that helps build products can also help break them.