{"id":13447,"date":"2026-09-19T01:01:39","date_gmt":"2026-09-19T01:01:39","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=13447"},"modified":"2026-09-19T01:01:39","modified_gmt":"2026-09-19T01:01:39","slug":"anthropics-claude-helped-3-researchers-breach-openai-in-under-72-hours","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=13447","title":{"rendered":"Anthropic\u2019s Claude helped 3 researchers breach OpenAI in under 72 hours"},"content":{"rendered":"

<\/p>\n

\n

Anthropic\u2019s Claude helped three security researchers breach OpenAI accounts and reach an internal code repository within 72 hours.<\/p>\n

Researchers at cybersecurity startup Hacktron chained an image-processing vulnerability with a flaw in OpenAI\u2019s identity infrastructure in July to gain access to multiple employees\u2019 ChatGPT and Codex accounts.<\/p>\n

One compromised Codex account was connected to OpenAI\u2019s GitHub organization, giving the researchers a path into the company\u2019s internal software environment.<\/p>\n

The team stopped after instructing the compromised employee\u2019s Codex account to create a harmless pull request inside OpenAI\u2019s private openai\/openai<\/code> monorepo. Hacktron said the researchers did not inspect proprietary source code.<\/p>\n

This week, Hacktron disclosed the vulnerabilities and ended further testing.<\/p>\n

OpenAI reportedly fixed the identity-side flaw roughly 14 hours after receiving the report and later paid the company a $6,500 bounty.<\/p>\n

Anthropic’s Opus 5 cleared a hurdle its predecessor could not<\/h2>\n

The OpenAI attack accelerated after Anthropic released Claude Opus 5, which overcame an exploitation hurdle that its predecessor had repeatedly failed to solve.<\/p>\n

Hacktron began examining the image-upload pipeline used by OpenAI\u2019s Discourse community forum on July 23. HEIC and HEIF files were processed through ImageMagick and the underlying libheif<\/code> decoding library, giving attacker-controlled images a path into vulnerable code.<\/p>\n

The researchers supplied Claude Opus 4.8 with a Discourse Docker image and asked it to inspect the installed libheif<\/code> package for security weaknesses. The model identified missing fixes that left a heap buffer overflow, enabling out-of-bounds reads and writes.<\/p>\n

By July 24, Opus 4.8 had produced an exploit that achieved code execution when address space layout randomization (ASLR) was disabled. But repeated attempts to make the exploit work reliably against Discourse\u2019s normal configuration with ASLR enabled failed.<\/p>\n

Anthropic released Opus 5 later that day, giving the researchers another route.<\/p>\n

\n

Related Reading<\/span><\/p>\n

How a fake AI supercomputer stole $24 million from hundreds of crypto investors<\/h3>\n<\/p>\n

<\/span> <\/div>\n

Hacktron opened a fresh session with the new model, which produced a working ARM64 exploit for a local Mac within about three hours. The researchers then asked it to adapt the exploit to the x86-64 architecture and jemalloc<\/code> memory configuration used by Discourse.<\/p>\n

By 6 a.m. on July 25, the team had a working exploit that could execute code through a malicious image upload.<\/p>\n

With that foothold established, the researchers next tested whether Claude could reproduce the attack against a remote environment with less human intervention.<\/p>\n

Hacktron placed the model in an autonomous loop against its own Discourse Cloud instance. The company said Claude initially refused to develop an exploit directly against a remote system, prompting the team to proxy the test environment so it resembled a capture-the-flag security challenge.<\/p>\n

Four hours later, the agent had reproduced the attack against the remote test environment.<\/p>\n

The researchers then used the resulting exploit against OpenAI\u2019s community forum, where they gained administrative access. A separate weakness in OpenAI\u2019s single-sign-on system allowed them to move from the forum into ChatGPT and Codex accounts.<\/p>\n