Researchers used Anthropic’s Claude to hack into OpenAI

In a twist that captures the unusual caller authorities of AI security, autarkic information researchers person utilized Anthropic’s Claude to interruption into OpenAI, exposing cracks successful the ChatGPT-maker’s defenses, The Wall Street Journal reported connected Thursday evening.

A three-person information squad astatine startup Hacktron AI carried retired the onslaught arsenic portion of an OpenAI bug-bounty program. Hacktron reported its findings to OpenAI, which gave the startup a $6,500 award. The squad managed to concatenation unneurotic 2 captious vulnerabilities to summation entree to aggregate OpenAI worker ChatGPT accounts, which gave them introduction into the company’s software.

OpenAI says it has resolved the issues Hacktron uncovered, which happens to travel astatine a infinitesimal erstwhile apical AI companies are nether growing unit implicit safety.

This incidental comes respective weeks aft OpenAI’s ain AI agents broke containment during a cybersecurity valuation and hacked Hugging Face, demonstrating conscionable however susceptible AI models are getting astatine making their ain decisions. It besides highlights however off-the-shelf exertion tin beryllium utilized to find vulnerabilities successful adjacent the astir precocious companies’ infrastructure.

“For $200 a month, anyone tin usage these tools and hack into a institution similar OpenAI,” Matt Fredrikson, CEO of AI information steadfast Gray Swan, told TechCrunch. “If it tin hap to them — and I don’t deliberation they’ve been slouching precocious connected cybersecurity hygiene —  it could hap to anyone.”

Or arsenic 1 AI pundit noted connected societal media: “[Hacktron] utilized Opus 5 to propulsion disconnected the hack…The question that volition beryllium asked is, if these 3 guys tin propulsion this off, what tin a federation authorities do.”

The researchers recovered a way into OpenAI connected July 25 via a flaw successful Discourse, the third-party bundle powering OpenAI’s assemblage forum.

According to a blog the researchers published, the introduction constituent was a mundane representation upload. When users posted HEIF oregon HEIC representation files (the format iPhones usage by default) to OpenAI’s assemblage forum, Discourse passed them done a concatenation of behind-the-scenes tools to person them into modular JPEGs. Its archetypal halt was ImageMagick, a decades-old, open-source inferior utilized to resize images. Because ImageMagick’s accustomed toolkit can’t woody with Apple’s format, it handed the record disconnected to different room called libheif to bash the decoding.

Buried wrong libheif was a representation bug that exposed a way for an attacker to sneak successful their ain instructions. In this case, feeding the room a specially crafted representation caused it to miscalculate wherever 1 representation was positioned connected apical of another, which proved capable to hijack the server.

What whitethorn beryllium uncomfortable for the cybersecurity assemblage is that bug had already been fixed months earlier by libheif’s developers. But the hole was ne'er formally flagged arsenic a vulnerability, meaning it ne'er got a CVE (common vulnerabilities and exposures) number, the industry’s modular mode to way known information weaknesses. Hacktron says that whitethorn explicate wherefore the bundle utilized by Discourse was inactive moving the susceptible version.

Notably, the researchers said the Claude exemplary they were utilizing — a peculiar mentation of Opus 4.8 made disposable for cybersecurity researchers — couldn’t physique a moving exploit astatine first. That changed overnight, erstwhile Anthropic released Opus 5.

“Opus 4.8 struggled crossed respective sessions to nutrient a moving exploit,” Hacktron wrote successful a blog post. “Within hours of Opus 5’s release, we gave it the aforesaid occupation and it succeeded.”

Once wrong the Discourse server, the researchers recovered different flaw that fto them instrumentality implicit users’ ChatGPT and Codex accounts, including those belonging to OpenAI employees.

“We past took implicit an OpenAI employee’s account, whose Codex was connected to OpenAI’s Github organization,” Hacktron wrote successful its summary of the event.

At this point, the researchers alerted OpenAI arsenic good arsenic Discourse, which issued a hole connected July 27.

The incidental puts a spotlight connected wherever the enactment gets drawn for exemplary capabilities. Claude Opus 5, the mentation that yet cracked the bug, hasn’t faced immoderate information export restrictions, dissimilar newer mentation Mythos 5, which was temporarily locked down implicit concerns astir its precocious hacking capabilities.

Those are conscionable the closed models. Open-weight models are progressively catching up to the frontier successful cyber capabilities. For example, AI information nonprofit SaferAI precocious recovered that Chinese institution Z.ai’s GLM-5.2 was lone a fewer months down OpenAI’s GPT-5.5 and Anthropic’s Claude Opus 4.7.

As Hacktron laminitis Mohan Pedhapati enactment it connected X: “AI is reducing the magnitude of scarce expertise needed to make exploits. Work that erstwhile took months tin present instrumentality days.”