bug bounty5 articles
Claude Opus 5 Cracked OpenAI Staff Accounts in Under 72 Hours
Security researchers at Hacktron used Anthropic's Claude Opus 5 to chain a memory corruption flaw in the libheif image-processing library with a weakness in OpenAI's single sign-on system, successfully taking over ChatGPT and Codex accounts belonging to several OpenAI employees and gaining access to an internal code repository. The attack began through OpenAI's public help forum, which used the same login system as internal tools, meaning compromising the forum server granted access wherever that sign-on was trusted. OpenAI patched the vulnerability within 14 hours of being notified and paid a $6,500 bounty, while the researchers note that Claude Opus 5 was critical to the effort, producing a working exploit within hours after the previous model had struggled — illustrating how capable AI is lowering the skill and time required for serious offensive security work.
Bug Hunters Used Anthropic's Claude to Crack OpenAI Employee Accounts
Security researchers from Hacktron used Anthropic's Claude AI models to discover and exploit vulnerabilities in OpenAI's community forum, ultimately taking over OpenAI employees' ChatGPT accounts and demonstrating access to an internal GitHub repository within 72 hours. The attack chained a heap buffer overflow flaw in the libheif image-processing library with a remote code execution exploit, with Claude Opus 5 proving crucial in generating a working exploit script. OpenAI patched the vulnerability within 14 hours and awarded the researchers a $6,500 bug bounty, while the researchers warned that cyberattacks previously requiring months of expert effort can now be carried out in days using AI assistance.
Researcher Pockets $78k After Finding Meta Support Data Wide Open
Security researcher Rony K Roy received a $78,000 bug bounty from Meta after discovering a critical vulnerability in Meta's backend support infrastructure, initially identified in January 2026. The flaw combined missing authorization, broken access control, and IDOR issues that, when chained together, could have allowed attackers to access sensitive customer support data, including emails, chat logs, and personal information shared with Meta support. Meta patched the vulnerability in April 2026 and found no evidence of malicious exploitation prior to the fix.
Opera GX's Mod Auto-Installer Let Attackers Silently Steal Your Gmail Address With Pure CSS
Researchers discovered a critical flaw in Opera GX that allowed malicious websites to silently auto-install a browser mod (a cosmetic add-on) without any user interaction or approval, then exploit it to steal data from other sites the victim visited. By packing the mod with ~150,000 CSS rules, attackers could reconstruct sensitive information like a Gmail address character by character through a cross-site leak technique, all within seconds of the victim landing on the malicious page. Opera has patched the vulnerability in version 130.0.5847.89, rated it their highest severity (P1), and paid the maximum $5,000 bounty, though the underlying auto-install behavior had been flagged as a risk since 2023.
Chrome Vulnerability Numbers Are Skyrocketing. AI Is Almost Certainly Why.
Google has seen a dramatic surge in Chrome vulnerability discoveries, with the number of internally found flaws jumping from a handful in March to 100 in a single advisory published on May 5, likely due to its use of AI tools. While Google has not explicitly confirmed AI is responsible, the timing aligns with its own statements that AI and automation are helping its teams remediate risks "at an unprecedented rate." Google has been developing AI-powered vulnerability discovery tools such as Big Sleep and CodeMender, and is also among a select group of organisations with access to Anthropic's powerful Claude Mythos model.