Claude Helped Researchers Breach OpenAI in 72 Hours

Hacktron researchers used Anthropic's Claude to chain an ImageMagick and libheif vulnerability with a flaw in OpenAI's identity infrastructure, reaching an internal code repository in under 72 hours. The team accessed multiple employees' ChatGPT and Codex accounts, then used one compromised Codex account's GitHub connection to reach OpenAI's private software environment. Researchers stopped after creating a harmless pull request and said they did not inspect proprietary source code.

Why it matters

The operation accelerated after Anthropic released Opus 5, which helped produce a working exploit after earlier attempts with Opus 4.8 failed against normal defenses using address space layout randomization. Hacktron said Opus 5 produced a local ARM64 exploit in about three hours, then adapted it to the x86-64 and jemalloc configuration used by Discourse. By July 25, the team had reproduced the attack against a remote test environment and used it against OpenAI's forum.

The episode illustrates the changing balance between attackers and defenders. Hacktron said skilled human guidance remained important, but its co-founder Mohan Pedhapati argued that AI is reducing the scarce expertise needed to develop exploits. The researchers also found that AI coding agents can widen the blast radius of a compromised account because integrations with GitHub, Slack, email and other services may be reachable.

Market impact

For AI companies and enterprise software buyers, the risk extends beyond model safety. Coding agents increasingly sit between employees and sensitive development infrastructure, concentrating permissions around a small number of platforms. A single identity weakness can therefore become a path into source repositories and connected services.

OpenAI fixed the identity-side flaw roughly 14 hours after receiving the report and paid Hacktron a $6,500 bounty. Discourse prepared a patch and added sandboxing around image processing. The next security test for AI adoption is whether companies can limit agent permissions as quickly as they expand agent access.