Researchers used Claude to break into OpenAI and were paid $6,500
A three-person security team chained two flaws to reach OpenAI's internal repositories using Claude Opus 5, then told OpenAI how they did it. It paid them a $6,500 bounty.
The strangest security story of the week belongs to OpenAI, and the headline almost writes itself: three researchers broke into the company behind ChatGPT using a rival's AI, then explained exactly how they did it. The team from the security startup Hacktron AI ran the attack inside OpenAI's own bug bounty programme and walked away with $6,500.
How the chain worked
The way in was almost mundane. OpenAI's community forum runs on Discourse, and when users uploaded HEIF or HEIC images - the format iPhones produce by default - Discourse passed them through ImageMagick, which handed the decoding off to a library called libheif. A memory bug in libheif let a specially crafted image miscalculate where one image sat on top of another, which was enough to hijack the server.
The uncomfortable part is that libheif's developers had already fixed that flaw months earlier. It was never formally flagged as a vulnerability, so it never received a CVE number, the industry's standard way of tracking known weaknesses, and Hacktron believes that is why the forum was still running the vulnerable version. From there the team found a second flaw that let them take over ChatGPT and Codex accounts, including an OpenAI employee's, whose Codex was connected to the company's GitHub organisation. To prove the access without reading anything sensitive, the researchers used that connection to open a pull request in OpenAI's internal repository.
Discovery to repository access took under 72 hours. OpenAI says it has resolved the issues Hacktron found, and Discourse shipped a fix on 27 July.
The model swap that did the trick
Hacktron's own write-up is blunt about the tooling. The cybersecurity-focused build of Claude Opus 4.8 the team had been using could not produce a working exploit across several sessions; within hours of Opus 5 arriving, the same problem fell. "Opus 4.8 struggled across several sessions to produce a working exploit," the researchers wrote. "Within hours of Opus 5's release, we gave it the same problem and it succeeded."
Why you should care
Matt Fredrikson, chief executive of the AI security firm Gray Swan, framed the fear for TechCrunch: for $200 a month, anyone can use these tools and hack into a company like OpenAI. Hacktron founder Mohan Pedhapati made the economics point - work that once took months of scarce expertise now takes days and a subscription.
Our opinion
The $6,500 bounty is the funniest detail here, and not because it is stingy. Bounties are priced on impact, not drama. What should genuinely worry security teams is that the libheif fix shipped without a CVE, because silent patches are exactly the conditions under which a repaired flaw keeps sitting unpatched in a live deployment while everyone waits for an advisory that never comes. That gap, not Claude, is the real finding here, and it is the one most likely to be quietly repeated somewhere else next month.