Bug Hunters Used Anthropic's Claude to Crack OpenAI Employee Accounts
Three researchers from Hacktron just demonstrated something that will make both AI labs squirm: they used Anthropic's Claude to compromise OpenAI employee accounts, access an internal GitHub repository, and walk away with a bug bounty cheque. The whole operation took under 72 hours.
Jaiswal, Pedhapati, and Maini chained two vulnerabilities together to pull it off. Their entry point was OpenAI's community forum, community.openai.com, which runs on Discourse. The forum used FastImage for image validation, but FastImage couldn't handle HEIF files. Those got quietly routed to ImageMagick, which called libheif to process them. That exposed the libheif parser directly to attacker-controlled input.
Using Claude Opus 4.8, the team identified a heap buffer overflow in libheif and tried to build a remote code execution exploit from it. That attempt stalled on Discourse's default configuration. Then Anthropic released Claude Opus 5. The researchers switched models, regenerated the exploit script, and got RCE on OpenAI's instance.
From there they took control of an OpenAI employee's account whose Codex was connected to OpenAI's internal GitHub organisation. Rather than rifle through the codebase, they had Codex open a harmless pull request in the internal monorepo as proof of access, then stopped. Responsible of them.
OpenAI patched the issue within roughly 14 hours of disclosure and paid out $6,500 through its Bugcrowd programme. It was careful to clarify the bounty covered the OpenAI-side finding specifically, since community.openai.com was technically outside the programme's scope. Discourse also patched on their end, adding image-processing sandboxing and publishing security advisory GHSA-vhm9-85gw-x335.
The researchers noted that any user logged into OpenAI's community forum, not just employees, could theoretically have had their ChatGPT and Codex accounts hijacked during the window the vulnerability was open. Given that users can connect Codex and ChatGPT to GitHub, Slack, and email, the potential blast radius was considerable.
The poetic dimension here is hard to ignore. Anthropic's flagship model was the tool used to breach its main rival's internal systems. Claude has previously shown willingness to conduct offensive security operations autonomously, as have OpenAI's own models. The researchers estimate the human effort involved amounted to a few hours, with an AI agent doing the heavy lifting over a few days.
As they put it: work that once needed a well-resourced team and months of effort can now be compressed into days. Security assumptions have not kept pace with what attackers can actually do.