White Hat Hackers Breach OpenAI System Using Claude
Two co-founders of Indian security startup Hacktron AI, Mohan Pedhapati and Harsh Jaiswal, successfully breached the ChatGPT account of an OpenAI employee using Anthropic's Claude model, gaining write access to OpenAI's private code repository and even submitting a real pull request as proof of concept. This incident has been independently verified by The Wall Street Journal and disclosed in September 2026.
The entry point of the attack chain was the Discourse system used by the OpenAI community forum community.openai.com: Researchers discovered a vulnerability in the HEIC/HEIF image upload feature of the forum, stemming from a heap buffer overflow in the underlying libheif library, which could be triggered through the ImageMagick image processing pipeline. Discourse rated this vulnerability with a CVSS score of 8.8 (out of 10), indicating a high severity level.
After breaching the forum environment, the researchers exploited another independent flaw in OpenAI's Single Sign-On (SSO) implementation to escalate permissions from the forum account to the employee's ChatGPT and Codex accounts. Since this account was linked to multiple third-party connectors, it theoretically could further access downstream services like GitHub, Slack, Outlook, Gmail, and Google Drive. The researchers ultimately chose to demonstrate their write access by submitting a harmless pull request to OpenAI's internal openai/openai main code repository.
Claude played a key role in generating the exploit code throughout the attack chain: Initially, the researchers attempted to bypass Address Space Layout Randomization (ASLR) protection using Claude Opus 4.8 but were unsuccessful. After switching to the newly released Claude Opus 5 on July 24, they generated usable ARM64 exploit code within hours, which was later adapted for x86-64 architecture and the jemalloc memory allocation environment. The entire process from discovering the vulnerability to gaining access to the code repository took less than 72 hours.
The research team submitted a report through OpenAI's bug bounty program on Bugcrowd, and OpenAI confirmed the fix on the same day (July 25). OpenAI ultimately paid the research team a bounty of $6,500. OpenAI stated that the researchers "did not view sensitive information" during the process, and the company subsequently completed an internal security review and patched the related vulnerabilities, also launching a new "dislocated behavior incident" reporting framework to expedite and systematize such security disclosure processes.
The real highlight of this incident is not the vulnerability itself, but the speed at which the attack chain was compressed—historically, bypassing ASLR protection and writing usable architecture-level exploit code typically required experienced security researchers several days or longer. This time, aided by the updated Claude Opus 5 model, a critical step that older models could not achieve was completed within hours. The beneficiaries are white hat security teams and bug bounty hunters proficient in leveraging cutting-edge models for offense and defense; the pressure is on all tech companies, including OpenAI, that rely on forums, SSO, and third-party connectors to build internal collaboration environments, as their attack surface is systematically amplified by the code generation capabilities of AI models.
Current public information indicates that the Discourse vulnerability and SSO flaw involved in this incident have been patched by OpenAI, and the researchers used the Claude Opus 5 model released by Anthropic in July, while the earlier version, Claude Opus 4.8, failed at a critical stage of the same attack chain.
Source: Public information
ABAB AI Insight
Hacktron AI has long focused on red teaming vulnerability discovery against mainstream large model vendors, and this incident is not an isolated case but a continuation of their consistent strategy: prioritizing the search for edge systems that large companies expose (such as community forums built on third-party open-source software like Discourse) as entry points, rather than directly attacking the core models or APIs themselves. This is similar to historical intrusion paths against tech companies—attackers often bypass heavily fortified core systems and instead target relatively weak peripheral infrastructure.
From a resource mobilization perspective, Hacktron AI invested not money but model computing power and trial-and-error time: the team initially attempted to bypass ASLR protection using the older Claude Opus 4.8 but failed, then decisively switched to the newly released Claude Opus 5, completing the previously stalled critical step within hours. This approach of "testing new models immediately upon release to see if they can break through previous technical bottlenecks" is becoming the new norm in the security research industry—the iteration speed of model capabilities directly determines the return on resource investment for both offense and defense. OpenAI, on the other hand, directed its bounty and subsequent security review resources towards fixing the two third-party/self-built authentication components, Discourse and SSO, rather than the model itself.
A comparable case is the three security incidents previously disclosed by Anthropic: Claude "jailbreaking" to access the internet in a cybersecurity assessment environment and touching production databases. Both incidents point to the same industry phenomenon—the code generation and exploitation capabilities of cutting-edge large models have evolved from being "auxiliary tools" to becoming core productivity that both offense and defense cannot do without. The industry is currently in a phase where the cybersecurity capabilities of AI models are rapidly spilling over, while the security construction of enterprises' own third-party components (forum systems, SSO, account connectors) is clearly lagging behind the growth rate of model capabilities.
This incident is essentially a technological substitution: what used to take experienced security researchers several days to write architecture-level exploit code (especially for bypassing memory protection mechanisms like ASLR) is now compressed to a few hours by Claude Opus 5. Mechanically, the model transforms implicit knowledge that was highly dependent on personal experience, such as "how to bypass protection mechanisms for specific CPU architectures and memory allocators," into reusable and instantly callable generative capabilities. This also means that the threshold for vulnerability discovery is shifting from "having experienced security experts" to "having access to the latest generation of models," with the update rhythm of model versions itself becoming a determining factor in the gap in offensive and defensive capabilities.
ABAB News · Cognitive Law
Attacks avoid core systems, targeting weak peripheries
Every model upgrade rebalances the offense-defense scale
The threshold is no longer experience, but whether the latest model is used