Three security researchers at cybersecurity startup Hacktron used Anthropic's Claude to breach OpenAI's systems in July, gaining access to employee ChatGPT and Codex accounts and reaching an internal code repository within 72 hours.
The researchers chained two vulnerabilities: an image-processing flaw in OpenAI's Discourse community forum and a weakness in the company's identity infrastructure. After gaining administrative access to the forum, they exploited the identity flaw to move into ChatGPT and Codex accounts. One compromised employee had connected their Codex account to OpenAI's GitHub organization, providing a path into the company's internal software environment.
The team stopped after instructing the compromised account to create a harmless pull request in OpenAI's private repository and did not access proprietary source code. Hacktron disclosed the vulnerabilities this week. OpenAI fixed the identity flaw approximately 14 hours after receiving the report and paid Hacktron a $6,500 bounty.
Claude Opus 5 Accelerated Exploit Development
The breakthrough came when Anthropic released Claude Opus 5 on July 24. Hacktron researchers had begun analyzing OpenAI's image-upload pipeline on July 23 using an earlier version, Claude Opus 4.8, which identified a heap buffer overflow in the libheif decoding library. However, attempts to make the exploit work against Discourse's standard configuration with address space layout randomization (ASLR) enabled repeatedly failed.
With Opus 5, researchers produced a working ARM64 exploit for a local Mac within three hours. They then adapted it to the x86-64 architecture and memory configuration used by Discourse. By July 25 at 6 a.m., they had a working exploit capable of executing code through malicious image uploads.
Hacktron placed Claude in an autonomous loop against its own test environment. The model initially refused to develop an exploit directly against a remote system until researchers framed it as a capture-the-flag challenge. The agent reproduced the attack against the remote environment within four hours.
AI Compression of Security Timelines
Hacktron co-founder Mohan Pedhapati said the episode demonstrated how AI was compressing exploit-development timelines. He stated: "Work that once took months can now take days. Even leading AI labs can be vulnerable."
Hacktron emphasized that the operation remained dependent on experienced human researchers, noting: "This was not completely autonomous hacking, and skilled human guidance remained important."
Security experts warned that the advantage of skilled researchers combined with AI may diminish as models improve. Robert Reith, founder of blockchain security firm Accretion, noted that while a gap remains between what skilled researchers plus AI can accomplish versus general users plus AI, "this gap may become smaller as AI absorbs this knowledge and intuition over time."
Expanded Risk from Compromised Coding Accounts
The same AI coding agents that accelerated exploit development also increased potential damage once a researcher gained control of an employee account. ChatGPT and Codex can connect to external services including GitHub, Slack, and email, meaning a compromised account may expose authorized integrations.
Security researchers warned that concentration of permissions around AI coding tools could make them increasingly attractive targets as such agents become more embedded in corporate development workflows. Codey Blakeney, research lead at Arcee, cautioned that risk could grow if software development becomes concentrated around a small number of AI providers, creating broader points of failure across engineering teams.
Maxime Fournes, CEO of AI safety advocacy group PauseAI, noted the breach highlighted an imbalance between attackers and defenders, with attackers needing to find only one overlooked weakness while defenders must secure a much broader attack surface.
OpenAI tightened access after the disclosure. Discourse prepared a patch by July 27 and added further sandboxing around its image-processing system.
