{"slug": "researchers-used-anthropic-s-claude-to-hack-into-openai", "title": "Researchers used Anthropic's Claude to hack into OpenAI", "summary": "A three-person security team at startup Hacktron AI used Anthropic's Claude to chain two critical vulnerabilities and gain access to multiple OpenAI employee ChatGPT accounts, earning a $6,500 award through OpenAI's bug-bounty program, The Wall Street Journal reported Thursday. Hacktron found the entry point on July 25 via a memory bug in the libheif library used by Discourse, the third-party software powering OpenAI's community forum, and OpenAI says it has resolved the issues. Hacktron reported that a special cybersecurity version of Anthropic's Opus 4.8 could not build a working exploit, but the release of Opus 5 changed that overnight.", "body_md": "In a twist that captures the strange new state of AI security, independent security researchers have used Anthropic’s Claude to break into OpenAI, exposing cracks in the ChatGPT-maker’s defenses, The Wall Street Journal [reported](https://www.wsj.com/tech/ai/hackers-used-anthropics-claude-to-break-into-openai-b40ba883) on Thursday evening.\n\nA three-person security team at startup [Hacktron AI](https://www.hacktron.ai) carried out the attack as part of an OpenAI bug-bounty program. Hacktron reported its findings to OpenAI, which gave the startup a $6,500 award. The team managed to chain together two critical vulnerabilities to gain access to multiple OpenAI employee ChatGPT accounts, which gave them entry into the company’s software.\n\nOpenAI says it has resolved the issues Hacktron uncovered, which happens to come at a moment when top AI companies are under [growing pressure over safety](https://techcrunch.com/2026/09/16/anthropic-and-openai-want-to-embed-safety-evaluators-will-they-really-be-independent/).\n\nThis incident comes several weeks after [OpenAI’s own AI agents broke containment](https://techcrunch.com/2026/07/21/openai-says-hugging-face-was-breached-by-its-pre-release-models/) during a cybersecurity evaluation and hacked Hugging Face, demonstrating just how capable [AI models are getting at making their own decisions](https://techcrunch.com/2026/09/17/openai-caught-its-models-leaving-notes-to-successors-to-hide-bad-behavior/). It also highlights how off-the-shelf technology can be used to find vulnerabilities in even the most advanced companies’ infrastructure. \n\n“For $200 a month, anyone can use these tools and hack into a company like OpenAI,” Matt Fredrikson, CEO of AI security firm Gray Swan, told TechCrunch. “If it can happen to them — and I don’t think they’ve been slouching recently on cybersecurity hygiene — it could happen to anyone.”\n\nOr as one AI pundit [noted](https://x.com/AndrewCurran_/status/2100773011855134828) on social media: “[Hacktron] used Opus 5 to pull off the hack…The question that will be asked is, if these three guys can pull this off, what can a nation state do.”\n\nThe researchers found a path into OpenAI on July 25 via a flaw in Discourse, the third-party software powering OpenAI’s community forum.\n\nAccording to a blog the [researchers published](https://www.hacktron.ai/blog/hacking-openai?utm_source=x&utm_medium=social-personal&utm_campaign=disclosure&utm_content=openai-launch), the entry point was a mundane image upload. When users posted HEIF or HEIC image files (the format iPhones use by default) to OpenAI’s community forum, Discourse passed them through a chain of behind-the-scenes tools to convert them into standard JPEGs. Its first stop was ImageMagick, a decades-old, open source utility used to resize images. Because ImageMagick’s usual toolkit can’t deal with Apple’s format, it handed the file off to another library called libheif to do the decoding.\n\nBuried inside libheif was a memory bug that exposed a path for an attacker to sneak in their own instructions. In this case, feeding the library a specially crafted image caused it to miscalculate where one image was positioned on top of another, which proved enough to hijack the server.\n\nWhat may be uncomfortable for the cybersecurity community is that bug had already been fixed months earlier by libheif’s developers. But the fix was never formally flagged as a vulnerability, meaning it never got a CVE (common vulnerabilities and exposures) number, the industry’s standard way to track known security weaknesses. Hacktron says that may explain why the software used by Discourse was still running the vulnerable version.\n\nNotably, the researchers said the Claude model they were using — a special version of Opus 4.8 made available for cybersecurity researchers — couldn’t build a working exploit at first. That changed overnight, when Anthropic released Opus 5.\n\n“Opus 4.8 struggled across several sessions to produce a working exploit,” Hacktron wrote in a [blog post](https://www.hacktron.ai/blog/hacking-openai#opus-5-released). “Within hours of Opus 5’s release, we gave it the same problem and it succeeded.”\n\nOnce inside the Discourse server, the researchers found another flaw that let them take over users’ ChatGPT and Codex accounts, including those belonging to OpenAI employees.\n\n“We then took over an OpenAI employee’s account, whose Codex was connected to OpenAI’s GitHub organization,” Hacktron wrote in its summary of the event.\n\nAt this point, the researchers alerted OpenAI as well as Discourse, which issued a fix on July 27.\n\nThe incident puts a spotlight on where the line gets drawn for model capabilities. Claude Opus 5, the version that ultimately cracked the bug, hasn’t faced any security export restrictions, unlike newer version Mythos 5, which was temporarily [locked down](https://techcrunch.com/2026/06/15/the-us-governments-anthropic-models-ban-was-never-about-an-ai-jailbreak/) over concerns about its advanced hacking capabilities.\n\nThose are just the closed models. [Open-weight models are increasingly catching](https://techcrunch.com/2026/08/04/open-weight-ai-models-are-catching-up-to-the-frontier-the-safety-gap-remains/) up to the frontier in cyber capabilities. For example, AI safety nonprofit SaferAI recently found that Chinese company Z.ai’s GLM-5.2 was only a few months behind OpenAI’s GPT-5.5 and Anthropic’s Claude Opus 4.7.\n\nAs Hacktron founder [Mohan Pedhapati put it on X:](https://x.com/s1r1u5_/status/2100777832297447442) “AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days.”", "url": "https://wpnews.pro/news/researchers-used-anthropic-s-claude-to-hack-into-openai", "canonical_source": "https://techcrunch.com/2026/09/18/researchers-used-anthropics-claude-to-hack-into-openai/", "published_at": "2026-09-18 00:00:00+00:00", "updated_at": "2026-10-03 09:38:53.131921+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "large-language-models", "ai-agents"], "entities": ["Anthropic", "Claude", "OpenAI", "Hacktron AI", "ChatGPT", "Discourse", "libheif", "ImageMagick"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/researchers-used-anthropic-s-claude-to-hack-into-openai", "markdown": "https://wpnews.pro/news/researchers-used-anthropic-s-claude-to-hack-into-openai.md", "text": "https://wpnews.pro/news/researchers-used-anthropic-s-claude-to-hack-into-openai.txt", "jsonld": "https://wpnews.pro/news/researchers-used-anthropic-s-claude-to-hack-into-openai.jsonld"}}