Claude vs. OpenAI: How the Maker of ChatGPT Was Hacked for $6,500

A storyline that perfectly captures the current state of security in the AI world: independent researchers hacked OpenAI using Claude — a model from its chief rival, Anthropic. TechCrunch reported this, citing The Wall Street Journal.

The attack was carried out by a three-person team from the startup Hacktron AI under OpenAI's bug-bounty program. The researchers chained together two critical vulnerabilities, gained access to the ChatGPT accounts of several company employees and used them to break into its systems. OpenAI paid the startup $6,500 for the find and says it has already fixed every problem uncovered.

The Way In Through an Image Upload

The point of entry on July 25 was a vulnerability in Discourse — the third-party engine that powers OpenAI's community forum. When a user uploaded an image in HEIF/HEIC format (the one the iPhone uses by default), Discourse ran the file through a conversion chain into ordinary JPEG. ImageMagick handled the first step, but, unable to work with Apple's format, it passed the file to the libheif library. That was where a memory-handling bug lurked: a specially crafted image caused the library to miscalculate how images were layered, which was enough to seize control of the server.

An unpleasant detail for the industry: this bug had been fixed by libheif's developers several months earlier, but the patch was never registered as a vulnerability — it was never assigned a CVE number. That, Hacktron believes, is precisely why Discourse kept running the vulnerable version. Once inside the server, the researchers found a second flaw that let them hijack ChatGPT and Codex accounts, including ones belonging to OpenAI employees. One of them was connected to the company's GitHub organization.

The Role of a Model Swap

Curiously, a special version of Claude Opus 4.8 built for security researchers spent several sessions unable to assemble a working exploit. Everything changed overnight: within a few hours of Opus 5's release, the same task was solved.

The incident sharpens the debate over where to draw the line on models' capabilities. Opus 5, which ultimately breached the system, is not subject to export restrictions — unlike the newer Mythos 5, which was temporarily blocked because of its advanced hacking abilities.

The conclusion experts draw is alarming. "For $200 a month, anyone can use these tools and hack a company like OpenAI. If it happened to them, it can happen to anyone," noted Gray Swan chief Matt Fredrikson. And Hacktron's founder put the essence of it this way: AI reduces the amount of rare expertise needed to build exploits — work that once took months now fits into days.

Source: TechCrunch