Independent security researchers from startup Hacktron AI used Anthropic’s Claude to break into OpenAI, chaining two critical vulnerabilities in the company’s community-forum software and gaining access to employee ChatGPT and Codex accounts. The work was carried out under OpenAI‘s bug-bounty program; Hacktron reported its findings and received a $6,500 award. OpenAI says it has resolved the issues.

The attack chain began on July 25 with an image upload to Discourse, the third-party software behind OpenAI‘s community forum. HEIF/HEIC files, the default image format on iPhones, were passed by Discourse to ImageMagick and then to the libheif decoding library. Hacktron found a memory bug in libheif that could be triggered by a specially crafted image, causing the library to miscalculate image positioning and letting the attacker hijack the server. The libheif developers had fixed the bug months earlier, but the fix was never assigned a CVE number, which may be why Discourse was still running the vulnerable version. Once inside the Discourse server, the team found a second flaw that let them take over ChatGPT and Codex accounts, including an OpenAI employee whose Codex was connected to OpenAI‘s GitHub organization. Hacktron alerted OpenAI and Discourse, which issued a fix on July 27.

A notable detail is the role of model iteration. Hacktron said the Claude version they started with, a special Opus 4.8 build for cybersecurity researchers, could not produce a working exploit over several sessions. After Anthropic released Opus 5, they gave it the same problem and it succeeded within hours. The incident feeds into broader concerns about AI-driven offensive security: off-the-shelf tools can be used against even well-defended companies, and model capability differences can sharply change the difficulty of developing exploits. The article notes that Claude Opus 5, the version that cracked the bug, had not faced security export restrictions, unlike newer Mythos 5, which was temporarily locked down over hacking capability concerns. Open-weight models are also approaching frontier capabilities; SaferAI found that Z.ai’s GLM-5.2 was only a few months behind OpenAI‘s GPT-5.5 and Anthropic’s Claude Opus 4.7. Hacktron founder Mohan Pedhapati said AI is reducing the scarce expertise needed to develop exploits, turning work that once took months into days.