A three-person team at security startup Hacktron AI used Anthropic’s Claude in an authorized OpenAI bug-bounty exercise, ultimately gaining access to OpenAI employee ChatGPT accounts and software systems, according to Hacktron’s account and reporting by TechCrunch. OpenAI awarded the researchers $6,500 and said the issues have been resolved.
The immediate story is not that an AI model independently breached a rival lab. The researchers identified and executed the path, while Claude helped with exploit development. But the incident is a concrete example of a broader operating change: advanced models can lower the time and specialist knowledge required to turn an overlooked software defect into a working attack.
What changed
Hacktron’s initial access point was OpenAI’s community forum, which ran on Discourse. The reported route began with uploaded HEIF or HEIC images. In processing those files, Discourse used ImageMagick and the `libheif` decoding library.
The researchers found a memory flaw in `libheif` that could be triggered with a specially crafted image, allowing server compromise. Crucially, Hacktron said the underlying issue had been fixed by `libheif` developers months earlier, but was not assigned a CVE—the common identifier many security teams use to track vulnerabilities. The Discourse deployment therefore remained on a vulnerable version.
After reaching the forum server, Hacktron found a second weakness that enabled takeover of ChatGPT and Codex accounts, including an OpenAI employee account connected to the company’s GitHub organization. The team reported the findings to OpenAI and Discourse; Discourse issued a fix on July 27, according to the report.
Hacktron said an earlier specialized Claude Opus 4.8 version failed across several attempts to produce a working exploit. When the team gave the same problem to Opus 5 after its release, it succeeded within hours. That comparison is notable, though it remains a single research team’s account rather than a general benchmark of model performance.
Why it matters to operators
The core exposure was not an exotic zero-day hidden in a frontier model provider’s proprietary AI stack. It was a dependency chain around common file handling and third-party community software. That is the uncomfortable but practical lesson for companies deploying AI tools: attackers may use models to move faster, but they will still often enter through ordinary infrastructure.
Teams should treat AI-assisted exploitation as a reason to tighten security fundamentals:
- Maintain a software bill of materials and an asset inventory that extends to forum, support, collaboration and developer tools.
- Patch based on upstream security fixes and release notes, not solely on CVE feeds. A missing CVE is not evidence that a fix is unimportant.
- Restrict how user uploads are processed, isolate conversion services, and review dependencies involved in parsing complex file formats.
- Minimize the privileges available from employee sessions and integrations. A compromised account should not automatically provide a route to source-code or production systems.
- Test detection and incident-response workflows against faster exploit iteration, including red-team exercises that use approved AI coding and analysis tools.
For founders, the implication is also commercial. Security posture can no longer be framed only as a compliance exercise for mature enterprises. The attack surface created by SaaS integrations, developer access, and open-source dependencies can become material well before a company has a large internal security team.
What to watch next
The incident will add pressure on model developers, enterprise buyers and regulators to distinguish between legitimate defensive research and capabilities that materially enable cyber abuse. It also strengthens the case for evaluating models not just on whether they can identify a flaw, but on whether they can reliably produce deployable exploit code.
The nearer-term test is more operational: whether organizations update their vulnerability-management programs for fixes that never enter standard CVE workflows, and whether identity and access controls can limit the damage when a peripheral service is compromised. AI may accelerate the attack cycle, but disciplined dependency management and privilege boundaries remain the first controls that determine its business impact.
