Security researchers used Claude Opus 5 to breach OpenAI's internal systems

A three-person team at security startup Hacktron AI used Anthropic's Claude models to find and exploit a vulnerability chain that gave them access to OpenAI employee accounts and the company's internal GitHub environment, with Claude Opus 5 succeeding where an earlier Claude model had stalled.

What's new

The entry point was mundane: image uploads to OpenAI's community forum, which runs on third-party Discourse software. When a user posts a HEIC or HEIF photo — the default format on iPhones — Discourse passes it through a chain of conversion tools to turn it into a standard JPEG. Hacktron's researchers found a flaw in that pipeline, in the libheif library, and used Claude to help develop a working exploit. As TechCrunch described the bug: "feeding the library a specially crafted image caused it to miscalculate where one image was positioned on top of another, which proved enough to hijack the server."

The capability jump between Claude versions is the more striking part of the story. The team first tried Claude Opus 4.8 and struggled across several sessions to produce a working exploit. After Anthropic released Claude Opus 5 on July 24, they gave it the same problem — and according to VentureBeat's account of the research, "Opus 5 produced a working ARM64 exploit within hours" after the earlier model had failed to get there.

From the initial forum compromise, the researchers chained a flaw in OpenAI's single sign-on implementation to escalate into an employee's ChatGPT and Codex accounts, and from there reached OpenAI's internal GitHub. The researchers reported the issue through OpenAI's Bugcrowd bounty program; OpenAI paid a $6,500 bounty and said it "narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions." Discourse shipped a fix for the underlying library flaw.

Context

The disclosure adds to a run of stories this year about frontier models being used — by both attackers and defenders — to find and exploit real software vulnerabilities faster than human researchers alone. It follows Anthropic's own disclosures about Claude being used in offensive cybersecurity contexts, and comes as rival labs including Google and OpenAI have separately disclosed instances of their own models exceeding intended boundaries during security testing. Unlike those incidents, this one involved human researchers directing an AI model deliberately, in a sanctioned bug-bounty engagement, rather than a model acting autonomously.

Why it matters

The headline number here isn't the bounty payout, it's the time and cost: a small team went from a suspected bug to full internal-repository access in under 72 hours, with the AI model doing the exploit-writing work that used to require specialized reverse-engineering expertise. VentureBeat's framing of the researchers' own conclusion is blunt: "For $200 a month, anyone can use these tools and hack into a company like OpenAI." That's the real signal for every company running public-facing forums, support tools or file-upload pipelines built on third-party software — the bar for finding and weaponizing that kind of flaw just dropped substantially, for defenders and attackers alike.