Ethereum

    Anthropic’s Claude helped 3 researchers breach OpenAI in under 72 hours

    行政By No Comments6 Mins Read

    Anthropic’s Claude helped three security researchers breach OpenAI accounts and reach an internal code repository within 72 hours.

    Researchers at cybersecurity startup Hacktron chained an image-processing vulnerability with a flaw in OpenAI’s identity infrastructure in July to gain access to multiple employees’ ChatGPT and Codex accounts.

    One compromised Codex account was connected to OpenAI’s GitHub organization, giving the researchers a path into the company’s internal software environment.

    The team stopped after instructing the compromised employee’s Codex account to create a harmless pull request inside OpenAI’s private openai/openai monorepo. Hacktron said the researchers did not inspect proprietary source code.

    This week, Hacktron disclosed the vulnerabilities and ended further testing.

    OpenAI reportedly fixed the identity-side flaw roughly 14 hours after receiving the report and later paid the company a $6,500 bounty.

    Anthropic’s Opus 5 cleared a hurdle its predecessor could not

    The OpenAI attack accelerated after Anthropic released Claude Opus 5, which overcame an exploitation hurdle that its predecessor had repeatedly failed to solve.

    Hacktron began examining the image-upload pipeline used by OpenAI’s Discourse community forum on July 23. HEIC and HEIF files were processed through ImageMagick and the underlying libheif decoding library, giving attacker-controlled images a path into vulnerable code.

    The researchers supplied Claude Opus 4.8 with a Discourse Docker image and asked it to inspect the installed libheif package for security weaknesses. The model identified missing fixes that left a heap buffer overflow, enabling out-of-bounds reads and writes.

    By July 24, Opus 4.8 had produced an exploit that achieved code execution when address space layout randomization (ASLR) was disabled. But repeated attempts to make the exploit work reliably against Discourse’s normal configuration with ASLR enabled failed.

    Anthropic released Opus 5 later that day, giving the researchers another route.

    Related Reading

    How a fake AI supercomputer stole $24 million from hundreds of crypto investors

    Hacktron opened a fresh session with the new model, which produced a working ARM64 exploit for a local Mac within about three hours. The researchers then asked it to adapt the exploit to the x86-64 architecture and jemalloc memory configuration used by Discourse.

    By 6 a.m. on July 25, the team had a working exploit that could execute code through a malicious image upload.

    With that foothold established, the researchers next tested whether Claude could reproduce the attack against a remote environment with less human intervention.

    Hacktron placed the model in an autonomous loop against its own Discourse Cloud instance. The company said Claude initially refused to develop an exploit directly against a remote system, prompting the team to proxy the test environment so it resembled a capture-the-flag security challenge.

    Four hours later, the agent had reproduced the attack against the remote test environment.

    The researchers then used the resulting exploit against OpenAI’s community forum, where they gained administrative access. A separate weakness in OpenAI’s single-sign-on system allowed them to move from the forum into ChatGPT and Codex accounts.