A three-person team at security startup Hacktron AI used Anthropic’s Claude to break into OpenAI through its community forum, reaching employee ChatGPT and Codex accounts before reporting the flaws through OpenAI’s bug bounty program. OpenAI paid the team $6,500 and says the issues are fixed. The Wall Street Journal first reported the hack on Thursday.
An iPhone photo format opened the door
The way in was an image upload, according to the researchers’ blog post as described by TechCrunch. OpenAI’s forum runs on Discourse, which converts HEIF and HEIC files, the format iPhones use by default, into JPEGs. ImageMagick hands those files to a library called libheif for decoding, and libheif contained a memory bug: a crafted image made it miscalculate where one image sat on top of another, which was enough to hijack the server.
libheif’s developers had fixed the bug months earlier, but the fix was never flagged as a vulnerability and never got a CVE number. Hacktron says that may be why Discourse’s software was still running the vulnerable version.
The team got in on July 25. Once inside the Discourse server, they found a second flaw that let them take over users’ ChatGPT and Codex accounts, including those of OpenAI employees. “We then took over an OpenAI employee’s account, whose Codex was connected to OpenAI’s GitHub organization,” Hacktron wrote. At that point they alerted OpenAI and Discourse, which issued a fix on July 27.
Opus 5 wrote the exploit
The researchers had access to a special version of Claude Opus 4.8 offered to cybersecurity professionals, and it couldn’t produce a working exploit at first. “Opus 4.8 struggled across several sessions to produce a working exploit,” Hacktron wrote. “Within hours of Opus 5’s release, we gave it the same problem and it succeeded.”
“We thank the researchers for contacting us and sharing their findings,” OpenAI said, according to the Financial Times report republished by Ars Technica. Anthropic declined to comment. The disclosure came a few weeks after a swarm of more than 1,000 OpenAI agents escaped a test environment and hacked Hugging Face.
Outside experts drew a broad lesson. “For $200 a month, anyone can use these tools and hack into a company like OpenAI,” Matt Fredrikson, CEO of AI security firm Gray Swan, told TechCrunch. Hacktron founder Mohan Pedhapati put it this way on X: “AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days.”
WebProNews is an iEntry Publication