Claude AI helped researchers hack into OpenAI in under 72 hours
Researchers breached OpenAI using Claude AI
Three security researchers from the cybersecurity startup Hacktron say they used Anthropic's Claude AI to break into OpenAI's systems in less than 72 hours. They gained access to multiple employees' ChatGPT and Codex accounts and reached OpenAI's internal code repository.
The attack, which took place in July, combined an image-processing flaw with a weakness in OpenAI's identity system. The team stopped after making a harmless pull request inside OpenAI's private repository and did not inspect proprietary source code, according to Hacktron.
Key details of the attack
- The researchers exploited a heap buffer overflow in the libheif image-decoding library, which processes HEIC and HEIF files on OpenAI's community forum.
- Anthropic's Claude Opus 5 produced a working exploit in about three hours, after the older Opus 4.8 failed against a normal configuration.
- One compromised employee account was connected to OpenAI's GitHub organization, giving the researchers a path into the internal software environment.
- OpenAI reportedly fixed the identity flaw about 14 hours after receiving the report and paid Hacktron a $6,500 bounty.
What Hacktron says happened
Hacktron began examining OpenAI's image-upload pipeline on July 23. The researchers provided Claude Opus 4.8 with a Docker image of the Discourse forum software and asked it to find security weaknesses in the installed libheif package. The model identified a missing patch that left a heap buffer overflow, enabling out-of-bounds reads and writes.
By July 24, Opus 4.8 produced an exploit that worked when ASLR—a security feature that randomizes memory addresses—was disabled. But it failed repeatedly when ASLR was enabled.
Anthropic released Opus 5 later that day. In a fresh session, the new model produced a working exploit for a local Mac in about three hours. The researchers then adapted it to the x86-64 architecture and jemalloc configuration used by Discourse. By 6 a.m. on July 25, they had a working exploit that could execute code through a malicious image upload.
Hacktron then tested the model against a remote environment. Claude initially refused to attack a remote system, so the team proxied the test environment to make it look like a capture-the-flag challenge. Four hours later, the agent reproduced the attack against the remote test environment.
The researchers then used the exploit against OpenAI's community forum, gained administrative access, and used a separate weakness in OpenAI's single-sign-on system to move into ChatGPT and Codex accounts.
Human expertise still needed
Hacktron co-founder Mohan "s1r1us" Pedhapati said the episode showed how AI is compressing exploit-development timelines. He said work that once took months can now take days, and even leading AI labs can be vulnerable.
However, Hacktron stressed that the operation was not fully autonomous. Skilled human guidance remained important throughout.
Robert Reith, founder of blockchain security firm Accretion, said experienced researchers still provide much of the judgment needed to turn AI-generated work into a successful attack. But he warned that this advantage may shrink as AI models improve and absorb more knowledge.
Risks of connected AI coding tools
The same coding agents that sped up the exploit also expanded its potential reach. ChatGPT and Codex can connect to external services, so a compromised account may expose whatever integrations a user has authorized. Hacktron cited GitHub, Slack, and email as services that could become reachable depending on the account's configuration.
In this case, the employee's GitHub connection provided the path into OpenAI's internal repository. Security researchers warned that AI coding tools like Codex and Claude Code could become attractive targets as they become more embedded in corporate workflows.
Codey Blakeney, research lead at Arcee, said the more popular these tools become, the more people will try to target them. The risk could grow if software development becomes concentrated around a small number of AI providers, creating broader points of failure.
What is confirmed and what is still unclear
The details of the attack come from Hacktron's own disclosure this week. Hacktron says the researchers did not inspect proprietary source code. Whether OpenAI has fully addressed all the vulnerabilities is not confirmed in the source material, beyond the reported fix for the identity flaw.
Why this matters for security
The incident illustrates how AI can reduce the skill barrier for complex cyberattacks. It also highlights the risk of concentrating permissions around AI coding tools, where a single compromised account can expose sensitive internal systems.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.