Researchers Use Claude to Breach OpenAI Employee Accounts
AI-powered exploit exposes vulnerabilities in OpenAI's internal systems.
1AI vs AI security showdown
Security researchers used Anthropic's Claude AI to hack into OpenAI employees' ChatGPT accounts, demonstrating how AI tools can be weaponized against their creators. The Hacktron team chained two vulnerabilities to gain access, then proved they could reach an internal OpenAI repository. This marks one of the first documented cases where one company's AI was used to breach another's systems. The entire attack timeline took less than 72 hours from discovery to repository access.
2Critical vulnerability chain
The exploit began with OpenAI's community forum running on Discourse, which used ImageMagick for HEIF image processing. Researchers found a heap buffer overflow flaw in libheif library. Initially, Claude Opus 4.8 helped identify the flaw but couldn't develop a working exploit. When Anthropic released Claude Opus 5, the team successfully generated a remote code execution script. This allowed them to bypass security measures that would normally require extensive human expertise.
3Internal access demonstration
After gaining access, researchers took over an OpenAI employee's account connected to GitHub. To demonstrate impact without accessing sensitive code, they sent a prompt to open a pull request in OpenAI's internal monorepo. The team immediately reported the vulnerability and ceased further testing. This ethical approach earned them a $6,500 bounty from OpenAI's bug bounty program, though OpenAI noted the Discourse exploit wasn't technically covered by their program.
4Rapid response and fixes
OpenAI fixed the vulnerability within 14 hours of receiving the report and marked the issue as resolved. Discourse also implemented a fix adding image-processing sandboxing and published security advisory GHSA-vhm9-85gw-x335. The quick resolution highlights how AI companies must maintain vigilance against emerging threats. Notably, the entire hack required just a few days of AI-assisted work and a few hours of human effort, demonstrating how AI accelerates both attack and defense capabilities.
5Expanded attack surface
The researchers emphasized how connected services increased potential damage. Since ChatGPT and Codex accounts could link to GitHub, Slack, and emails, account takeover could have provided broad internal access. The team noted this vulnerability existed until two months prior, meaning any user or employee logging into OpenAI's help forum could have been compromised. This highlights the growing risks of interconnected AI services in enterprise environments.
6AI's dual-use dilemma
The attack underscores how generative AI models like Claude can autonomously develop exploits without human guidance. Both Anthropic's and OpenAI's models have demonstrated this capability, creating an arms race in AI security. The researchers warn that work requiring months of human effort can now be compressed into days using AI. This paradigm shift demands new security assumptions that account for AI-powered attackers' enhanced capabilities.
7Bug bounty nuances
OpenAI clarified that testing against their Discourse-hosted community forum was explicitly excluded from their bug bounty program. The award recognized the OpenAI-side finding rather than actions against Discourse. This distinction highlights the complexities in modern bug bounty programs when vulnerabilities span multiple platforms. The $6,500 reward reflects the serious nature of the find while acknowledging technical limitations in bounty scope.
8New security paradigm
This incident establishes a precedent for AI-assisted cybersecurity research and attacks. The researchers conclude that security assumptions must evolve to match AI-enhanced attacker capabilities. As AI models become more sophisticated at vulnerability discovery and exploit development, organizations must implement more robust defenses. The case serves as a wake-up call for AI companies to audit their own systems using the same tools potential attackers might employ.