Hackers used Anthropic's Claude to infiltrate OpenAI
A security researcher at cybersecurity startup Hacktron AI has reported successfully accessing OpenAI's internal data using Anthropic's Claude.
Hacking OpenAI | Hacktron AI
Exclusive | Hackers Used Anthropic's Claude to Break Into OpenAI - WSJ
https://www.wsj.com/tech/ai/hackers-used-anthropics-claude-to-break-into-openai-b40ba883
Researchers used Claude to hack OpenAI - Ars Technica
https://arstechnica.com/ai/2026/09/researchers-used-claude-to-hack-openai/
In July 2026, security researchers at Hacktron AI successfully used Claude to exploit a configuration flaw in the OpenAI Developer Community , OpenAI's community forum, and gained access to an OpenAI employee's ChatGPT account. Because ChatGPT can connect to a variety of services, Hacktron AI noted that 'the theoretically accessible range was very broad, including GitHub, Slack, and email.'
The OpenAI Developer Community uses Discourse, an open-source internet forum system. An investigation into Discourse revealed that HEIC and HEIF files were following an unusual path in the image upload pipeline.
Discourse typically uses the FastImage image display component for image checking, but since FastImage does not support HEIF, these files were converted using the ImageMagick magick command, which can perform image format conversions. Hacktron AI reports that this allowed the underlying parser to directly access files controlled by the attacker.
Using a Discourse Docker image, Claude Opus 4.8 was instructed to check the installed libheif package for security issues, and it was discovered that certain security fixes had not been backported to the libheif package. This could potentially lead to a heap buffer overflow and the use of out-of-bounds read/write primitives during HEIC decoding.
Subsequently, Hacktron AI developed an exploit using Claude Opus 4.8 that worked with ASLR disabled. They then requested that the exploit be ported to the x86-64 environment and configuration used by Discourse using the newly released Claude Opus 5. Ultimately, they succeeded in developing an exploit that allowed local remote code execution via image upload.
'Claude Opus 5' appears, offering equivalent performance to the Claude Fable 5 at half the price with relaxed limitations - GIGAZINE
Researchers at Hacktron AI used this exploit to successfully hijack the ChatGPT and Codex accounts of OpenAI Developer Community users. The hijacked Codex account belonged to an OpenAI employee and was connected to OpenAI's GitHub repository, allowing them to access internal code, view confidential software information, and propose changes.
Hacktron AI reportedly accessed OpenAI's internal monorepo via a compromised Codex account, left a message confirming its successful unauthorized access, and did not conduct any further tests.
Hacktron AI reported the vulnerability it discovered through OpenAI's bug bounty program and successfully received a $6,500 (approximately 1.02 million yen) reward. OpenAI commented on the event, saying, 'We thank the researchers who contacted us and shared their findings.' As of the time of writing, the bug in question has already been fixed.
Hacktron AI stated, 'We want to emphasize that this vulnerability is not unique to Discourse. It is an issue with OpenAI's single sign-on (SSO), and as a result, the forum compromise led to access to ChatGPT and Codex. If any first-party or third-party service using OpenAI's SSO is compromised, similar access will be possible. Discourse was just one example of this.'
According to Hacktron AI, the total value of AI tokens used to discover this vulnerability and find ways to exploit it was less than $3,000 (approximately 470,000 yen).
Related Posts:
