Researchers used Claude to hijack OpenAI staff accounts and reach the company's private code

Hacktron says Opus 5 built the exploit that worked on the forum's real configuration, within hours of its release. A three-person team did the rest on off-the-shelf subscriptions, and OpenAI paid a $6,500 bounty.

In a blog post, a three-person team at the AI security startup Hacktron describes using Anthropic's Claude to break into the accounts of several OpenAI employees. One of those accounts, The Wall Street Journal reports, gave them a way to read and propose changes to OpenAI's private code store. The whole effort took under 72 hours.

The way in was OpenAI's community forum, which runs on third-party software called Discourse. It converted uploaded HEIF images, the format iPhones use by default, through an open-source library called libheif. A memory bug there had been fixed a year earlier, but the change was never flagged as a security issue or given a CVE, the public identifier that distributors watch. Hacktron thinks that is why the forum's package still carried it.

Claude Opus 4.8 found the unpatched library and wrote an exploit. It failed against the forum's normal setup, which keeps a standard memory defense on. Anthropic released Opus 5 on the evening of July 24, and Hacktron says the new model produced one that worked with the defense on.

Opus 5 at first refused to write an exploit aimed at a remote target, Hacktron says, until the team made its own test forum look like a capture-the-flag exercise and set the model running on its own. By the next morning it had run code on Discourse's hosted service; OpenAI's forum followed.

The forum lets people sign in with their OpenAI accounts, and Hacktron says a flaw on OpenAI's side of that sign-in let it take over the ChatGPT and Codex accounts of forum users, several OpenAI employees among them. One had linked Codex to OpenAI's GitHub organization. To prove the access without reading internal code, the team had that account open a pull request in the repository, then stopped.

OpenAI confirmed its side was fixed about 14 hours after Hacktron's report and paid a $6,500 bounty, which it says covers only that OpenAI-side flaw because testing against the forum was outside its program. Discourse had a fix by July 27.

Hacktron calls the wider campaign HEIF Heist: over two months it adapted the attack to Slack, Meta and GitHub Enterprise among others, for under $3,000 in tokens. As far as the researchers know, only Shopify noticed.

Mohan Pedhapati, Hacktron's chief technology officer, told The Wall Street Journal that his team, working on ordinary Claude and Codex subscriptions, is not as strong as Chinese threat actors. Matt Fredrikson, who runs the AI security firm Gray Swan, considers OpenAI careful about security. He told TechCrunch that anyone paying $200 a month for these tools could breach a company like it.