https://techcrunch.com/2026/09/18/researchers-used-anthropics-claude-to-hack-into-openai/
Independent security researchers have used Anthropic’s Claude AI model to breach OpenAI’s defences, gaining access to multiple employee accounts and entry into the company’s internal software systems in what has been described as a striking illustration of how accessible and powerful AI-assisted hacking has become. The three-person team at startup Hacktron AI carried out the attack as part of OpenAI’s own bug bounty program, reported their findings to the company, and received a $6,500 award. OpenAI has since resolved both vulnerabilities the researchers exploited. The attack chain began on 25 July through a flaw in Discourse, the third-party platform powering OpenAI’s community forum, where a memory bug buried inside an image processing library called libheif could be triggered by uploading a specially crafted image file. When users posted photos in iPhone’s default HEIF or HEIC format, Discourse passed them through a conversion chain that included the decades-old open source utility ImageMagick, which handed Apple-format files to libheif for decoding. A flaw in how libheif calculated image positioning proved sufficient to hijack the server. Critically, the bug had already been patched by libheif’s developers months earlier, but because the fix was never formally flagged as a security vulnerability it never received a CVE tracking number, meaning the vulnerable version remained in use by Discourse’s software stack without being flagged for urgent update.
Once inside the Discourse server, the researchers found a second flaw that allowed them to take over users’ ChatGPT and Codex accounts including those belonging to OpenAI employees. One compromised employee account had Codex connected to OpenAI’s GitHub organisation, providing a significant level of internal access. Discourse issued a fix on 27 July after being alerted. A notable detail in the researchers’ account is that the Claude model initially available to them, a special cybersecurity-focused version of Opus 4.8, was unable to build a working exploit across multiple sessions. That changed when Anthropic released Opus 5, which solved the same problem within hours of its launch. AI is reducing the amount of scarce expertise needed to develop exploits and that work which once took months can now take days.