Claude Opus 5 Helped Researchers Breach OpenAI in Under 72 Hours
Fundacion Rapala – Claude Opus 5 Security research has drawn attention after a small white-hat team used Anthropic’s AI model during an authorized investigation that reached OpenAI employee accounts and an internal code repository. The incident was not described as a criminal attack. Instead, Hacktron AI researchers worked under responsible disclosure and ultimately received a bug bounty. Their path began with OpenAI’s public community forum, which runs on Discourse, rather than ChatGPT itself. Researchers found an image-processing weakness involving the libheif library and later chained it with an OpenAI sign-in flaw. That combination expanded their access to employee ChatGPT and Codex accounts. They eventually demonstrated access to an internal repository through a harmless pull request without examining sensitive source code, according to published reports. From initial investigation to repository access, the entire research process reportedly took less than 72 hours.
Claude Opus 5 Security Research Changed the Experiment
The most striking part of the story involves how quickly AI capabilities changed during the research. Hacktron initially worked with Claude Opus 4.8 while investigating the vulnerable image-processing component. That model helped identify important details, but researchers said it struggled to create a reliable exploit under realistic memory protections. The situation changed after Anthropic released Claude Opus 5. Hacktron gave the newer model the same technical challenge, and it reportedly produced a working ARM64 exploit within hours. The team then adapted its research for the environment used by Discourse. This does not mean an AI independently decided to attack OpenAI. Human researchers selected the target, interpreted results, controlled the investigation, and reported the vulnerabilities. Still, the episode illustrates an important shift. Advanced AI systems can potentially compress specialized security work that previously demanded far more manual effort, especially when experienced researchers guide the process carefully.
Read More : AI-Tuned RTX 5090 Laptop Breaks Power Limit and Delivers Huge Performance Gains
An Image Processing Weakness Opened the First Door
The technical journey began in a surprisingly ordinary place: image uploads. OpenAI’s community forum uses Discourse, which processes user-submitted images through several software components. Researchers discovered that certain HEIC and HEIF images could reach ImageMagick and subsequently the libheif decoding library. The relevant environment contained a vulnerable libheif version with a memory-corruption problem. Hacktron developed that weakness into remote code execution during its controlled security testing. This detail matters because modern online platforms depend on enormous software supply chains. A user may see only a simple upload button, while several libraries work behind the interface to decode, resize, inspect, and store an image. Therefore, security depends not only on the visible application but also on every component underneath it. The research highlights why old or overlooked dependencies can become significant entry points even when the primary product has strong security controls.
One Vulnerability Alone Was Not Enough
Gaining code execution on the community forum did not automatically provide access to OpenAI’s internal environment. The researchers still needed another weakness to move further. According to multiple reports, Hacktron discovered a separate problem involving OpenAI’s single sign-on implementation. By chaining the forum compromise with that identity weakness, the team could take over ChatGPT and Codex accounts associated with users who had authenticated through the affected service. Some of those accounts belonged to OpenAI employees. This second step transformed a software vulnerability into a broader identity-security problem. The episode therefore offers a useful lesson beyond artificial intelligence. Organizations increasingly connect applications through shared authentication systems because they make everyday work easier. However, those connections can also widen the impact of one compromised service. When a lower-trust platform shares identity relationships with sensitive tools, security teams must carefully control which permissions and sessions can travel across those boundaries.
Read More : NVIDIA Rejects RTX 5090 RMA After Serial Number Fades
Researchers Reached an Internal Repository but Stopped
The investigation eventually reached an OpenAI employee account whose Codex environment was connected to the company’s GitHub organization. At that stage, researchers demonstrated the impact by having the account create a harmless pull request in an internal repository. Importantly, Hacktron said the team did not examine or download sensitive source code after proving the access. The researchers instead reported their findings and ended the experiment. That distinction separates responsible vulnerability research from malicious intrusion. OpenAI subsequently addressed the issue, while Discourse also patched the image-processing vulnerability. Reports indicate OpenAI awarded Hacktron $6,500 through its bug bounty program, with the payment covering the OpenAI-side finding. The sequence shows why responsible disclosure programs remain valuable. Security researchers can demonstrate serious weaknesses without exploiting them for personal gain. Meanwhile, companies gain an opportunity to close those gaps before malicious actors discover and abuse the same paths.
Less Than 72 Hours Raises Bigger Security Questions
The timeline may be more significant than the identity of either AI company involved. Hacktron reportedly moved from initial investigation to access involving OpenAI’s repository environment in less than 72 hours. Although AI agents performed substantial technical work, human researchers still contributed several hours of interaction, judgment, and direction. That combination provides a glimpse into how cybersecurity work may evolve. Skilled specialists can increasingly delegate repetitive investigation, code analysis, and experimentation to capable models while focusing on strategy and interpretation. The same efficiency could strengthen defensive security because teams can discover vulnerabilities faster. However, it may also reduce the time available for organizations to react when previously unknown weaknesses appear. The story is therefore not simply about Claude versus ChatGPT. It reflects a broader change in the economics of cybersecurity. As AI tools improve, both vulnerability discovery and remediation may need to operate at much faster speeds.
White-Hat Research Matters in the AI Security Race
It would be misleading to describe the incident simply as Claude autonomously hacking ChatGPT. Three experienced security researchers directed the work, combined separate weaknesses, interpreted the model’s output, and made decisions about where to stop. Their actions also occurred within a responsible security-research context. Nevertheless, Claude Opus 5 appears to have materially accelerated one difficult part of the process: developing a reliable exploit from a memory-corruption weakness. That capability deserves attention because similar tools will continue improving. For defenders, the answer is not necessarily to fear AI-assisted security research. Instead, organizations can use the same technology to review dependencies, analyze vulnerabilities, test authentication boundaries, and prioritize patches. The human element remains equally important. Researchers chose restraint after demonstrating access, while OpenAI and Discourse addressed the reported problems. That cycle of discovery, disclosure, and repair remains one of cybersecurity’s most important safeguards.
AI Is Changing the Speed of Cybersecurity
The Hacktron experiment offers a preview of a security landscape where sophisticated AI becomes part of everyday research. Previously, turning memory corruption into a dependable exploit could demand extensive specialist knowledge and substantial manual experimentation. AI does not eliminate that expertise, but it can amplify it. This creates pressure on software companies to shorten patching cycles and monitor dependencies more closely. It also makes identity architecture increasingly important because one compromised service can become a bridge toward more valuable systems. OpenAI reportedly fixed its side of the reported issue rapidly after disclosure, while Discourse issued security fixes for affected software. For ordinary users, there is no indication in the available reports that the disclosed chain was used as a real-world attack against the public. The larger story concerns how quickly security capabilities are evolving. AI is becoming a tool for finding weaknesses, while defenders must increasingly use equally capable technology to close them.