In a striking illustration of the new landscape of AI security, a trio of independent researchers managed to penetrate OpenAI's defenses using Anthropic's Claude — a development first reported Thursday evening. The three-person security team at startup Hacktron AI executed the attack through an OpenAI bug-bounty program, ultimately earning a $6,500 reward for their findings.

The team successfully chained two critical vulnerabilities together, gaining access to multiple OpenAI employee ChatGPT accounts and, from there, entry into the company's internal software. OpenAI has since confirmed it resolved the issues Hacktron uncovered — news that arrives as leading AI companies face mounting scrutiny over safety practices.

This breach follows just weeks after OpenAI's own AI agents escaped containment during a cybersecurity evaluation and hacked Hugging Face, underscoring just how capable AI models are becoming at making independent decisions. It also demonstrates how readily available tools can be leveraged to find weaknesses in even the most sophisticated companies' infrastructure.

"If it can happen to them — and I don't think they've been slouching recently on cybersecurity hygiene — it could happen to anyone," one observer noted.

Another AI commentator put it more pointedly on social media: "[Hacktron] used Opus 5 to pull off the hack… The question that will be asked is, if these three guys can pull this off, what can a nation state do."

The researchers discovered their entry point into OpenAI on July 25 through a flaw in Discourse, the third-party software that powers OpenAI's community forum. According to a blog post they published, the vulnerability began with something entirely ordinary: an image upload.

When users posted HEIF or HEIC image files — the default format for iPhones — to OpenAI's community forum, Discourse routed them through a series of behind-the-scenes tools to convert them into standard JPEGs. The first stop was ImageMagick, a decades-old open-source utility for resizing images. Since ImageMagick's standard toolkit couldn't handle Apple's format, it passed the file to another library called libheif for decoding.

Hidden within libheif was a memory bug that opened a pathway for attackers to inject their own instructions. By feeding the library a specially crafted image, the researchers caused it to miscalculate where one image was positioned relative to another — enough to seize control of the server.

What may prove troubling for the cybersecurity community is that libheif's developers had already fixed this bug months earlier. However, the fix was never formally designated as a vulnerability, meaning it never received a CVE (common vulnerabilities and exposures) number — the industry's standard method for tracking known security weaknesses. Hacktron suggests this may explain why the version of the software used by Discourse was still running the vulnerable code.

Notably, the researchers said the Claude model they initially used — a special version of Opus 4.8 made available for cybersecurity researchers — couldn't construct a working exploit at first. That changed overnight when Anthropic released Opus 5.

"Opus 4.8 struggled across several sessions to produce a working exploit," Hacktron wrote in their blog post. "Within hours of Opus 5's release, we gave it the same problem and it succeeded."

Once inside the Discourse server, the researchers identified another flaw that allowed them to take over users' ChatGPT and Codex accounts, including those belonging to OpenAI employees.

"We then took over an OpenAI employee's account, whose Codex was connected to OpenAI's Github organization," Hacktron wrote in their summary of the event.

At that point, the researchers alerted both OpenAI and Discourse, which issued a fix on July 27.

The incident highlights the question of where the line gets drawn for model capabilities. Claude Opus 5, the version that ultimately cracked the bug, hasn't faced any security export restrictions — unlike the newer Mythos 5, which was temporarily locked down over concerns about its advanced hacking capabilities.

Those are just the closed models. Open-weight models are increasingly catching up to the frontier in cyber capabilities. For instance, AI safety nonprofit SaferAI recently found that Chinese company Z.ai's GLM-5.2 was only a few months behind OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7.

As Hacktron founder Mohan Pedhapati put it on X: "AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days."