Security researchers at Hacktron AI used Anthropic's newly released Claude Opus 5 to help build an exploit that led to access to ChatGPT and Codex accounts, including accounts belonging to OpenAI employees, on 25 July.
The researchers ultimately demonstrated access to OpenAI's internal GitHub repository through an employee's Codex account. They stopped without examining proprietary source code and reported the flaws to OpenAI and Discourse.
OpenAI later paid Hacktron a $6,500 bug bounty for the OpenAI-side vulnerability.
The incident highlights an unusual consequence of rapidly improving AI cybersecurity capabilities. Technology developed by one of OpenAI's biggest AI rivals helped security researchers expose weaknesses affecting the ChatGPT maker.
Claude Opus 5 Succeeded Where Its Predecessor Struggled
Hacktron began examining OpenAI's Discourse-powered community forum on 23 July. The researchers focused on how the site processed HEIC and HEIF image files.
The team first used Claude Opus 4.8 to inspect the libheif image-processing software. According to Hacktron, the model identified missing security fixes and helped develop an exploit that worked when address space layout randomisation, or ASLR, was disabled.
Making the exploit reliable under Discourse's default configuration proved harder. Hacktron said repeated Opus 4.8 sessions failed to make it work with ASLR enabled.
Then Anthropic released Claude Opus 5 on 24 July.
The researchers gave the new model the same problem. Hacktron said Opus 5 produced a working ARM64 exploit for a local Mac in about three hours. The team then used it to help adapt the exploit to the x86-64 environment and jemalloc configuration used by Discourse.
The Wall Street Journal reported that the researchers had access to a version of Claude made available to qualified cybersecurity practitioners.
By 25 July, Hacktron had demonstrated remote code execution through a malicious image upload. The researchers described the difference between the model generations as significant, writing that 'every new model is getting increasingly capable.'
From OpenAI's Forum to Employee Accounts
Compromising the forum was only the first stage.
OpenAI's community site used a 'Sign in with OpenAI' identity flow. Hacktron said it discovered a separate flaw in OpenAI's single sign-on system.
That flaw allowed control of the compromised forum environment to be turned into access to ChatGPT and Codex accounts belonging to users who had signed into the forum. Those users included OpenAI employees.
The researchers eventually reached an employee account whose Codex environment was connected to OpenAI's GitHub organisation.
Instead of examining proprietary source code, Hacktron said it instructed Codex to create a harmless proof-of-concept pull request inside OpenAI's internal openai/openai monorepo.
The pull request demonstrated the level of access without requiring the researchers to inspect sensitive code. Hacktron then stopped further testing and alerted OpenAI.
The researchers said the entire path from the initial discovery to demonstrating access to OpenAI's repository environment took less than 72 hours.
OpenAI Paid Hacktron $6,500
Hacktron submitted its findings through OpenAI's Bugcrowd bug bounty programme on 25 July.
According to the researchers' disclosure timeline, OpenAI confirmed that its side of the vulnerability had been fixed later that day, roughly 14 hours after the initial submission.
Hacktron separately reported the Discourse vulnerability through HackerOne.
Discourse responded on 26 July and had a fix ready by 27 July. On 28 July, it published a security advisory covering the remote-code-execution flaw and added more sandboxing around image processing as a defence-in-depth measure.
OpenAI marked Hacktron's report resolved on 1 September and awarded the researchers $6,500.
However, the bounty carried an important distinction.
According to Hacktron's disclosure, OpenAI said testing against the Discourse-hosted community forum was outside the scope of its bug bounty programme. The $6,500 payment therefore recognised the OpenAI-side identity vulnerability rather than the researchers' testing of Discourse.
Hacktron Says AI Is Making Sophisticated Hacking Cheaper
The OpenAI case grew out of a wider Hacktron research project called 'HEIF Heist,' which examined vulnerabilities in image-processing software used across multiple services.
Hacktron said three researchers worked on the broader project for about two months and spent less than $3,000 on AI model tokens. Once an exploit technique had been developed, adapting it to individual targets typically took one or two days.
The researchers stressed that the work was not fully autonomous. Skilled humans still selected targets, guided the models and made important decisions.
What changed, Hacktron argued, was how much technically difficult work a small team could complete.
Turning memory-corruption vulnerabilities into dependable exploits has traditionally required specialised expertise, substantial time and detailed knowledge of a target environment.
Hacktron's research suggests frontier AI models can now perform more of that work under human direction. That could reduce the time and cost required for legitimate security research.
It also creates a challenge for technology companies. The same capabilities that can help defenders uncover serious vulnerabilities more quickly could lower some of the barriers to sophisticated attacks when used maliciously.
