Claude Opus 5 Helped Three Researchers Breach OpenAI

A three-person cybersecurity team used Anthropic’s Claude Opus 5 to exploit a chain of vulnerabilities at OpenAI. In less than three days, their demonstration took them from a public community forum to employee accounts, before showing that one of those accounts could potentially provide a path into OpenAI’s internal GitHub environment.

This was not a criminal attack. Hacktron AI was conducting responsible security research and deliberately stopped once the team had demonstrated how far the vulnerability chain could reach.

The first step began on community.openai.com, OpenAI’s public forum, which runs on Discourse, a widely used platform for online communities. When users uploaded certain HEIC or HEIF images, the forum relied on several software components to process and convert them, including ImageMagick and an open-source library called libheif. The flaw was in that library.

By uploading a specially crafted image, the researchers could trigger a memory error on the server. Properly exploited, that error could do far more than crash the service. It could allow an attacker to execute code remotely on the forum server, a class of vulnerability known as remote code execution, or RCE.

RCE flaws are considered particularly serious because they can allow an outsider to take control of part of the targeted system.

Discourse later confirmed the vulnerability and rated it 8.8 out of 10 for severity. The flaw has since been patched, and image processing was further isolated to reduce the risk that a similar issue could affect other parts of the system. But compromising the forum alone was not enough to reach OpenAI’s internal services.

The researchers then found a second weakness in the way the forum communicated with OpenAI services. By gaining sufficient control over the forum environment, Hacktron says it was able to recover authentication material linked to some users who had signed in there. In other words, the forum flaw could become a gateway into certain ChatGPT and Codex accounts, including those belonging to OpenAI employees.

One of those Codex accounts was connected to OpenAI’s internal GitHub organization. GitHub is the platform developers use to store, review and modify source code. At that point, the researchers were in a position to explore private OpenAI repositories, but they deliberately chose a far more limited test.

Instead, they asked Codex to prepare a harmless change inside OpenAI’s large internal code repository, known as a monorepo. That was enough to show OpenAI how serious the chain of vulnerabilities could become without unnecessarily accessing sensitive source code.

The operation would likely have been far harder without Claude Opus 5. Hacktron says the model, released on July 24, was able within hours to produce a working exploit for ARM64, an architecture used by many modern processors. It then helped the researchers adapt the technique to the x86-64 environment used by Discourse.

That does not mean Claude independently decided to “hack OpenAI.” Human researchers selected the targets, directed the tests and decided each step of the operation. The model acted as a highly advanced technical assistant, helping analyze the code, understand the vulnerability and accelerate exploit development.

That is what makes the case particularly significant. Work that once required highly specialized expertise and substantial time can increasingly be accelerated by AI models capable of reasoning over complex code.

Hacktron reported the vulnerabilities on July 25, prompting OpenAI to strengthen parts of its security setup. On September 1, the company ultimately paid the researchers a $6,500 bounty through its bug bounty program.