Three security researchers used Anthropic’s Claude models to break into OpenAI’s internal systems through the company’s community forum. The attack took less than 72 hours and, according to the team, only became possible once Opus 5 shipped.

OpenAI is getting a taste of its own medicine. After inadvertently letting agents hack their way across the internet for months, the company has now been hacked with AI’s help. Hacktron’s security team chained two vulnerabilities together to access OpenAI employees’ ChatGPT and Codex accounts. From there, they broke into OpenAI’s internal code repository on GitHub.

The attack ran through OpenAI’s community forum at community.openai.com. Any user or employee who had used “Sign in with OpenAI” there was potentially affected. Users can connect GitHub, Slack, and email to Codex and ChatGPT, so the attack could theoretically have reached those services too. To prove they had access, the researchers used an employee’s Codex account to create a harmless pull request in the internal monorepo. They say they didn’t view any sensitive data.

An outdated image library and flawed authentication opened the door

The first vulnerability was in libheif, the library the forum used to process uploaded HEIC images. According to Hacktron, a fix had been available in the original source code for a year, but no one had flagged it as a security issue. The Debian packages running on the forum still lacked the fix. A crafted image file let the researchers run their own code on the server.

The second vulnerability was a misconfiguration in OpenAI’s central single sign-on (SSO) system. Anyone controlling the forum server could impersonate active forum members and take over their ChatGPT and Codex accounts. The flaw extended beyond the forum, Hacktron writes. Any compromised service using OpenAI login would have granted the same access.

Claude Opus 5 succeeded where its predecessor failed

The researchers say they initially used Claude Opus 4.8 to find the vulnerability. The model built a working exploit, but only with ASLR, a common defense against memory attacks, disabled. Across several sessions, it couldn’t produce a reliable version with ASLR enabled.

On the evening of July 24, Anthropic released Claude Opus 5. According to Hacktron, the new model produced a working exploit for a local Mac within three hours, then adapted it to the Discourse server environment. The researchers then ran Claude in an autonomous loop against their own test instance.

Because the model refused to write exploits against real systems, they presented the target as a benchmark task. Four hours later, the agent had taken over the server. On a related task, the researchers also observed a jump in performance compared to OpenAI’s GPT-5.6 Sol.

OpenAI confirmed the fix about 14 hours after the report. Discourse, the software behind the forum, also responded within days.

AI is making attacks drastically cheaper

Beyond the OpenAI hack, the researchers expanded their investigation, dubbed “HEIF Heist”, to cover Slack, Meta, GitHub Enterprise, and other targets. Three people carried out the project over two months, spending less than $3,000 on AI. Adapting the attack to each new target took just one to two days. Only Shopify noticed the activity, despite thousands of image uploads and repeated crashes in image processing.

Software has long benefited from a kind of security through complexity, the Hacktron team writes. Even with public source code and a known vulnerability, building a reliable exploit required rare expertise, time, and deep knowledge of the target environment. Complexity wasn’t a true security barrier, but it did protect many companies in practice.

AI strips away that protection by replacing scarce expertise with computing power. Hacktron argues that threat models must reflect how cheap attacks have become. “Work that once required a well-resourced team and months of effort can now be compressed into days,” the team writes.