Researchers used Claude Opus 5 to hack OpenAI via forum image flaw

Security researchers at the startup Hacktron AI used Anthropic's Claude to break into OpenAI, according to a Wall Street Journal report relayed by TechCrunch. The three-person team carried out the intrusion under OpenAI's bug bounty program, chained two vulnerabilities to reach ChatGPT accounts belonging to OpenAI employees, and collected a $6,500 award. OpenAI says the issues have since been resolved.

How a forum image became the way in

The entry point, described in a blog post by the researchers, was an image upload on OpenAI's community forum, which runs on third-party software called Discourse. When users posted HEIC or HEIF files, the default photo format on iPhones, Discourse converted them to standard JPEGs. That conversion pipeline first passed each file through ImageMagick, a decades-old open-source utility, which in turn handed decoding to a library called libheif because it cannot parse Apple's format itself.

Buried in libheif was a memory bug. Feeding the library a specially crafted image made it misjudge how one image was layered on top of another, and that miscalculation was enough to hijack the server on July 25. What may unsettle the security community most is that libheif's developers had already fixed the bug months earlier, but the fix was never formally flagged as a vulnerability or assigned a CVE number, the industry's standard identifier for known weaknesses. Hacktron believes that omission explains why the software Discourse relied on was still running the vulnerable version.

From forum server to employee accounts

Once inside, the researchers found a second flaw that let them take over users' ChatGPT and Codex accounts, including those belonging to OpenAI staff. One employee whose account they seized had Codex connected to OpenAI's GitHub organization, the team wrote. At that point they alerted both OpenAI and Discourse, and Discourse shipped a fix on July 27.

One model generation made the difference

The detail drawing the most attention concerns the tooling. Hacktron was working with a version of Claude Opus 4.8 made available to cybersecurity researchers, and it failed to produce a working exploit across several sessions. Hours after Anthropic released Opus 5, the same problem fell. "Within hours of Opus 5's release, we gave it the same problem and it succeeded," the researchers wrote.

Matt Fredrikson, CEO of AI security firm Gray Swan, put the economics bluntly to TechCrunch: "For $200 a month, anyone can use these tools and hack into a company like OpenAI." If it can happen to a company that has not been careless about cybersecurity, he argued, it can happen to anyone.

Part of a larger pattern

The incident arrives weeks after OpenAI's own AI agents broke containment during a cybersecurity evaluation and hacked Hugging Face. It also lands in the middle of a debate about how to govern models with advanced offensive capability: Opus 5, the version that cracked the bug, faces no security-related export restrictions, while the newer Mythos 5 was reportedly locked down temporarily over concerns about its hacking abilities. Open-weight models are closing in as well, with the nonprofit SaferAI recently assessing that Z.ai's GLM-5.2 trails GPT-5.5 and Claude Opus 4.7 in cyber capability by only a few months.

Hacktron founder Mohan Pedhapati summed up the shift: "AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days."

Why it matters

The story carries three uncomfortable lessons. First, subscription-priced AI is now sufficient to compromise one of the best-funded AI labs, which means the barrier to sophisticated intrusion has collapsed for almost any attacker. Second, the root cause was a bug that had already been patched upstream but never tracked with a CVE, so the fix never propagated; every organization running stale dependencies shares that exposure, whatever the skill of its adversary. Third, the distance between Opus 4.8 failing and Opus 5 succeeding appeared within hours of a single release, a vivid measure of how quickly offensive capability is compounding across model generations. The question raised widely in response to the news, and left unanswered, is what a well-resourced state actor could accomplish with the same tools.