AI Cyber Shockwave: Anthropic's Claude Breaches OpenAI's Defenses!

In a significant cybersecurity event that underscores the evolving landscape of artificial intelligence security, independent researchers successfully leveraged Anthropic’s advanced AI model, Claude Opus 5, to breach OpenAI’s systems. This incident, reported by The Wall Street Journal and detailed by the research team from Hacktron AI, exposed critical vulnerabilities within the ChatGPT-maker’s defenses, leading to a $6,500 award as part of OpenAI’s bug-bounty program.

The three-person security team at Hacktron AI meticulously chained together two distinct critical vulnerabilities to gain unauthorized access. This sophisticated attack ultimately granted them entry into multiple OpenAI employee ChatGPT accounts, which in turn provided a pathway into the company’s internal software infrastructure. OpenAI has since confirmed that the issues uncovered by Hacktron AI have been resolved, an announcement that comes amidst heightened scrutiny over AI safety and security practices across the industry.

The initial point of compromise was identified on July 25 through a flaw in Discourse, the third-party software that powers OpenAI’s community forum. The researchers discovered that a seemingly innocuous action – uploading HEIF or HEIC image files, the default format for iPhones – initiated a chain of events leading to the exploit. When these image files were posted to the forum, Discourse processed them through a series of backend tools designed to convert them into standard JPEGs. The first stop in this conversion process was ImageMagick, a long-standing, open-source utility for image resizing. ImageMagick, unable to directly handle Apple’s HEIF format, then passed the file to another library known as libheif for decoding.

Crucially, a memory bug was discovered buried within libheif. This specific bug, although previously fixed by libheif’s developers months prior, had never been formally flagged as a vulnerability and thus lacked a Common Vulnerabilities and Exposures (CVE) number – the industry-standard identifier for known security weaknesses. This oversight likely explains why the version of libheif running within Discourse’s software remained unpatched and vulnerable. By feeding the library a specially crafted image, Hacktron AI caused it to miscalculate the positioning of one image on top of another, a manipulation sufficient to hijack the Discourse server.

Once inside the Discourse server, the researchers unearthed a second critical flaw that enabled them to escalate their access. This vulnerability allowed them to take control of user accounts for both ChatGPT and Codex, including those belonging to OpenAI employees. Significantly, one compromised employee’s Codex account was found to be connected directly to OpenAI’s GitHub organization, providing a clear path to sensitive company assets. Upon this discovery, Hacktron AI promptly alerted both OpenAI and Discourse, with the latter issuing a fix on July 27.

A remarkable aspect of this breach was the pivotal role played by artificial intelligence. Initially, the Claude model used by the researchers – a special version of Opus 4.8 tailored for cybersecurity research – struggled to construct a functional exploit. However, a significant turning point occurred overnight with Anthropic's release of Opus 5. Hacktron AI noted in their blog post that "Opus 4.8 struggled across several sessions to produce a working exploit... Within hours of Opus 5’s release, we gave it the same problem and it succeeded." This stark contrast highlights the rapid and accelerating advancements in AI capabilities, particularly in complex problem-solving and exploit generation.

This incident vividly demonstrates how readily available, "off-the-shelf" AI technology can be utilized to uncover sophisticated vulnerabilities even within the most advanced technology companies. As Matt Fredrikson, CEO of AI security firm Gray Swan, remarked, "For $200 a month, anyone can use these tools and hack into a company like OpenAI." This sentiment echoes the broader concern that if an organization like OpenAI, known for its robust cybersecurity hygiene, can be breached in this manner, then virtually any entity is susceptible. The implications extend to national security, with one pundit on social media questioning, "if these three guys can pull this off, what can a nation state do?"

The event also reignites debates around the boundaries of AI model capabilities and their potential for misuse. While Claude Opus 5, the model instrumental in this hack, has not faced security export restrictions, newer, even more potent versions like Mythos 5 have been temporarily locked down due to concerns over their advanced hacking capabilities. Furthermore, the cyber capabilities of open-weight models are rapidly catching up to those of frontier closed models. For instance, SaferAI recently found that Chinese company Z.ai’s GLM-5.2 was only a few months behind OpenAI’s GPT-5.5 and Anthropic’s Claude Opus 4.7 in terms of capability. As Hacktron founder Mohan Pedhapati articulated, "AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days." This accelerating trend points to a future where sophisticated cyberattacks become more accessible and frequent, necessitating a continuous re-evaluation of cybersecurity strategies and AI safety protocols.