Security researchers at Hacktron AI used Anthropic’s Claude models to help exploit vulnerabilities that led to access to OpenAI employee ChatGPT and Codex accounts and demonstrated a path into OpenAI’s internal software infrastructure.
The incident, reported by The Wall Street Journal and other outlets, highlights an emerging cybersecurity challenge: advanced AI coding models can help security researchers automate parts of sophisticated vulnerability research and exploit development. OpenAI said the vulnerabilities were fixed after they were reported.
The researchers did not publicly claim to have stolen OpenAI’s proprietary source code. Instead, they used the compromised access to demonstrate what an attacker could potentially reach by having an employee’s AI development environment connected to internal services.
How the OpenAI Security Breach Started
The investigation began with OpenAI’s community forum, which runs on the Discourse platform.
Hacktron researchers discovered that specially crafted HEIC or HEIF image files could reach vulnerable image-processing software used by the forum. The processing chain involved ImageMagick and the libheif library.
According to security researchers, a heap buffer overflow in the affected library could be turned into remote code execution. That provided an initial foothold on the forum infrastructure. Discourse separately confirmed an upstream libheif vulnerability and released security fixes for affected systems.
The significance of this first vulnerability was that it did not directly provide access to OpenAI’s internal code. Instead, it created an entry point that could be combined with another weakness.
Claude Helped Develop the Exploit
Hacktron said it used Anthropic’s Claude models while researching and developing the exploit.
The researchers initially worked with Claude Opus 4.8, which reportedly struggled to produce a reliable exploit in the relevant environment. After Anthropic released Claude Opus 5, the researchers tried the task again.
According to Hacktron’s account, Claude Opus 5 was able to help produce a working exploit within hours. The researchers then adapted the technique to the infrastructure involved in the attack.
The development process illustrates how AI coding systems are increasingly being used in cybersecurity research. Instead of manually writing every component of an exploit, researchers can use AI models to analyze code, suggest techniques, generate software and troubleshoot failed attempts.
Hacktron reported that the complete route from initial investigation to demonstrating access to OpenAI’s internal repository took less than 72 hours.
The Second Vulnerability Involved OpenAI’s Sign-In System
After gaining remote code execution through the forum infrastructure, the researchers identified another issue involving OpenAI’s authentication system.
The researchers said authentication tokens associated with the forum could be used to reach ChatGPT and Codex sessions. Some of the affected accounts belonged to OpenAI employees.
This created a chain in which a vulnerability in a third-party forum environment could potentially become an identity-access problem affecting OpenAI accounts.
The researchers subsequently gained control of an OpenAI employee’s account and found that the account’s Codex environment was connected to OpenAI’s GitHub organization.
Researchers Demonstrated Access to OpenAI’s Internal GitHub
Rather than examining sensitive proprietary source code, Hacktron used the compromised Codex environment to demonstrate the level of access available.
The researchers instructed Codex to create a harmless pull request in OpenAI’s private software repository. Reports identify the demonstration as a way of proving that the compromised account could interact with OpenAI’s internal development infrastructure.
This distinction is important. The incident demonstrated a potential path into internal systems, but the researchers said they stopped short of examining sensitive source code.
For companies deploying AI coding assistants, the incident illustrates why permissions and integrations matter. An AI account connected to GitHub or other enterprise services may inherit access that goes far beyond the chatbot itself.
OpenAI Paid a $6,500 Bug Bounty
Hacktron reported the vulnerabilities to OpenAI and Discourse as part of responsible security research.
OpenAI reportedly paid the researchers $6,500 for the OpenAI-side vulnerability. The researchers said testing of the Discourse-hosted forum itself was outside the scope of OpenAI’s bounty program.
OpenAI subsequently addressed the reported issues. Reports indicate that the company revoked affected sessions and tokens and tightened permissions associated with community sign-in systems.
The researchers’ work was therefore presented as an ethical security disclosure rather than an attempt to maintain unauthorized access.
Why AI-Powered Cybersecurity Is Changing
The incident has broader implications for cybersecurity because the researchers used AI to accelerate technically demanding work.
Memory-corruption vulnerabilities and exploit development can traditionally require specialized knowledge of programming languages, operating systems, memory management and defensive technologies.
AI coding agents can now assist with portions of that workflow.
The Hacktron case reportedly involved using Claude to investigate the vulnerable software, develop exploit components and adapt the resulting code to different environments. The human researchers remained responsible for directing the operation, validating results and deciding how the access would be demonstrated.
This suggests that AI is becoming a tool for both defensive security research and offensive capability development.
AI Agents Create New Security Challenges for Businesses
The OpenAI incident also highlights a separate problem: modern AI tools are increasingly connected to enterprise systems.
A single employee account may have access to:
- ChatGPT or other AI assistants
- GitHub repositories
- Cloud infrastructure
- Internal documents
- Development environments
- Collaboration platforms
If an attacker compromises an AI-enabled account, the potential impact can therefore extend beyond the AI application itself.
Security teams may need to treat AI-agent credentials as seriously as other privileged identities, particularly when those agents can take actions on behalf of employees.
OpenAI and Discourse Patched the Reported Issues
OpenAI said the vulnerabilities identified by the researchers were addressed, while Discourse also released fixes for the underlying image-processing vulnerability.
The episode nevertheless demonstrates how vulnerabilities can become more serious when multiple systems are connected.
A weakness in an image-processing component may appear isolated. A separate authentication issue may also appear limited. But when those weaknesses are chained together, the resulting attack path can reach much more sensitive systems.
The Bigger Lesson for AI Security
The Hacktron incident is less about one AI company breaking into another and more about the changing relationship between AI and cybersecurity.
Claude did not independently decide to attack OpenAI. Human researchers directed the investigation and used the model as part of their technical workflow.
At the same time, the case demonstrates that increasingly capable AI coding models can reduce the time and effort required for sophisticated security research.
For businesses, the lesson is clear: software dependencies need to remain patched, authentication systems need strong isolation, and AI agents should receive only the permissions they actually require.
As AI systems become more deeply integrated with development environments and corporate infrastructure, securing the AI account may become just as important as securing the traditional applications and services connected to it.
Discover more from AiTechtonic - AI & Informative News
Subscribe to get the latest posts sent to your email.