Researchers Used Anthropic’s Claude AI to Breach OpenAI Systems

How the breach unfolded

A team of three researchers from Hacktron AI used Anthropic’s Claude, a large language model (LLM), to help them break into OpenAI’s systems. According to reports from Ars Technica↗ (opens in a new tab), TechCrunch↗ (opens in a new tab), and The Verge↗ (opens in a new tab), the researchers were participating in OpenAI’s bug bounty programme, which pays security professionals to find and report vulnerabilities before malicious actors can exploit them.

The team exploited a flaw in Discourse, the third-party software that hosts OpenAI’s community forum. By uploading a specially crafted HEIF image file (the default format for iPhones), they triggered a bug in the image processing pipeline. This allowed them to gain control of the server running the forum.

What the attackers accessed

Once inside the Discourse server, the researchers found another vulnerability that let them take over ChatGPT and Codex accounts belonging to OpenAI employees. With access to an employee’s account, they could reach OpenAI’s internal GitHub repository, known as “Monorepo.” This repository reportedly contains sensitive code and algorithmic details.

The researchers did not access or alter the internal code itself but demonstrated their access by submitting a pull request (a way to suggest changes in code) from the compromised account. They reported the flaws to OpenAI and Discourse, both of which have since fixed the vulnerabilities. OpenAI paid the researchers $6,500 for their work.

The role of Claude and AI in cyber security

The Hacktron team used Claude Opus 4.8 and, later, Opus 5, versions of Anthropic’s AI model designed for security research. According to Hacktron, Opus 4.8 struggled to create a working exploit, but Opus 5 succeeded within hours of its release. This highlights how advances in AI are making it easier and faster to discover and exploit vulnerabilities.

The researchers spent less than $3,000 in AI usage costs and completed the attack in under 72 hours. They noted that work which once took months can now be done in days with the help of advanced language models.

Industry and regulatory context

This incident comes at a time when AI companies face increasing scrutiny over the security of their models and infrastructure. The US government has recently debated how to regulate and restrict the release of advanced AI tools, including temporarily blocking some versions of Anthropic’s models due to concerns about their hacking capabilities.

The vulnerabilities exploited in this case had already been fixed in the underlying software (libheif) months earlier, but the fix was not flagged as a security issue and did not receive a CVE identifier. This meant that Discourse was still using a vulnerable version, underscoring the importance of clear vulnerability reporting and patch management.

What users and organisations should do

For ordinary users, there is no evidence that customer data was accessed or that the flaws were exploited by malicious actors. OpenAI and Discourse have patched the issues. For security professionals, this case is a reminder to:

• Monitor third-party software for updates, even if fixes are not labelled as security patches
• Review image processing pipelines and other less obvious attack surfaces
• Consider how AI tools might accelerate both attack and defence

The bigger picture

This story demonstrates the growing role of AI in both finding and exploiting vulnerabilities. As language models become more capable, the expertise required to develop exploits is decreasing. Security teams should expect attackers, both ethical and malicious, to use AI as a force multiplier, making rapid detection and response even more critical.