In a striking example of modern OpenAI security breach vulnerabilities, independent security researchers at startup Hacktron AI used Anthropic’s Claude to break into OpenAI systems, exposing critical weaknesses in the ChatGPT-maker’s defenses. The three-person team chained together two critical vulnerabilities to gain access to multiple OpenAI employee ChatGPT accounts as part of an official bug-bounty program, earning a $6,500 award for their findings.
How the OpenAI security breach unfolded
The researchers found their entry point on July 25 through a flaw in Discourse, the third-party software powering OpenAI’s community forum. The attack began with something mundane: users uploading HEIF or HEIC image files—the format iPhones use by default. When Discourse processed these images, it passed them through a chain of tools to convert them into standard JPEGs, including ImageMagick, a decades-old open-source utility, and a library called libheif for decoding Apple’s format.
A memory bug buried inside libheif proved to be the weak link. When fed a specially crafted image, the library miscalculated where one image was positioned on top of another—enough to hijack the server. Notably, this bug had already been fixed months earlier by libheif’s developers, but the fix was never formally flagged as a vulnerability with a CVE (common vulnerabilities and exposures) number, the industry standard for tracking known security weaknesses. That oversight likely explains why Discourse was still running the vulnerable version.
Claude’s evolving role in the OpenAI security breach
What makes this incident particularly noteworthy is the role of AI itself. Hacktron initially used a special version of Opus 4.8 made available for cybersecurity researchers, but it struggled to produce a working exploit. Everything changed overnight when Anthropic released Opus 5. “Within hours of Opus 5’s release, we gave it the same problem and it succeeded,” Hacktron wrote in their blog post.
Once inside the Discourse server, the researchers discovered a second flaw that allowed them to take over employee ChatGPT and Codex accounts, including one connected to OpenAI’s GitHub organization. They alerted OpenAI immediately, and Discourse issued a fix on July 27. OpenAI has since resolved the issues uncovered.
As covered earlier, OpenAI Model Escaped Restricted Environment to Hack Hugging Face demonstrated similar concerns about AI model capabilities. The incident underscores a troubling reality: AI is democratizing exploit development. “For $200 a month, anyone can use these tools and hack into a company like OpenAI,” Matt Fredrikson, CEO of AI security firm Gray Swan, told TechCrunch. In a related development, Google AI Mode adds flight price tracking and hotel booking tools highlighted how accessible advanced AI tools have become for various applications. The broader implication is stark—if it can happen to OpenAI, it could happen to anyone.
المصدر: TechCrunch
