Using magic to defeat magic, OpenAI was "hacked" by Claude...

An ironic security incident is drawing attention: researchers, using Anthropic's latest Claude Opus 5, gradually expanded an image processing vulnerability into a complete attack chain, ultimately gaining access to an OpenAI employee's ChatGPT account and further accessing OpenAI's internal GitHub environment. This signifies that AI is rapidly escalating cybersecurity attacks and defenses, quickly lowering the barrier to entry and cost of exploiting advanced vulnerabilities.

Researchers at security startup Hacktron AI disclosed the aforementioned actions this week. According to a recent report in The Wall Street Journal, the team gained access to an OpenAI employee's ChatGPT account and the ability to read and submit changes to OpenAI's proprietary software. Hacktron stated that the researchers completed the disclosure on July 25th through OpenAI's Bugcrowd bug bounty program. OpenAI confirmed that day that it had fixed the vulnerability on its side and paid the research team a $6,500 bounty.

The key issue in this incident is not just the exploitation of a single vulnerability, but rather the interconnectedness of multiple security boundaries: vulnerabilities in third-party infrastructure, flaws in federated identity authentication, and AI agent accounts deeply integrated with the enterprise's internal systems. For enterprises deploying AI agents on a large scale , this attack path means that previously dispersed security risks can be chained together into a complete chain of permissions by AI accounts.

Full attack chain overview: from image upload to internal codebase

The initial entry point for this attack was the OpenAI community forum community.openai.com, which runs on the Discourse platform.

Hacktron discovered that HEIC and HEIF images uploaded to Discourse were processed by ImageMagick and then decoded by libheif. Researchers pointed out that the libheif version in the relevant environment contained a heap buffer overflow vulnerability, which could be exploited as a remote code execution (RCE) vulnerability. Discourse subsequently confirmed the vulnerability and released a security advisory on July 28, giving it a CVSS score of 8.8, while also patching the vulnerability and strengthening its image processing sandbox.

But breaching the forum server was only the first step. Hacktron subsequently discovered another flaw in OpenAI's Single Sign-On (SSO) implementation, allowing researchers to further escalate control of the forum environment to access ChatGPT and Codex accounts, including OpenAI employee accounts. The researchers emphasized that this escalation of privileges was not a Discourse vulnerability, but rather a separate issue at the OpenAI authentication level.

After gaining access to the employee Codex account, researchers discovered that the account was connected to OpenAI's GitHub organization and instructed Codex to create a harmless pull request in OpenAI's internal monorepo (openai/openai) to demonstrate that the account intrusion could extend further to the developer infrastructure while avoiding reading sensitive source code.

Claude Opus 5 compresses exploitation time to within 72 hours.

Another noteworthy aspect of this incident is that the AI model was directly involved in the development of the exploit.

Hacktron stated that researchers initially used Claude Opus 4.8 to analyze the vulnerable libheif and attempted to develop an exploit, but struggled to reproduce the vulnerability stably with Address Space Layout Randomization (ASLR) enabled. Anthropic released Claude Opus 5 on July 24, positioning it as a significant upgrade for long-running agents and programming tasks.

After switching to Opus 5, the model generated a usable ARM64 exploit within hours, which was then adapted to the x86-64 and jemalloc environments used by Discourse. Hacktron stated that the entire process, from discovering the vulnerability to gaining access to the OpenAI codebase, took less than 72 hours.

This case demonstrates that AI agents are reducing the time cost of exploiting advanced vulnerabilities. In the past, discovering memory corruption vulnerabilities and developing stable exploits typically required extensive reverse engineering, debugging, and development work, but advanced programming models can now handle a significant portion of this work under human guidance.

AI agent accounts become the new hub of permissions.

Compared to a single vulnerability, the deeper impact of this incident on enterprise security architecture may stem from the location of the AI agent account.

Hacktron points out that affected ChatGPT or Codex accounts may be connected to multiple services such as GitHub, Slack, Outlook, Gmail, and Google Drive. Once an AI account is compromised, attackers may further inherit privileges on downstream systems associated with it. The AI account thus transforms from a single application credential into an identity and authorization hub connecting code, communications, and enterprise data.

Hacktron also includes this OpenAI event as part of the broader "HEIF Heist" research, stating that the same approach extends to platforms such as Slack, Meta, Zoom, Shopify, and GitHub Enterprise. However, currently, publicly disclosed technical details and vendor confirmations primarily focus on the OpenAI case.

For enterprise security teams, this incident highlights several key protection priorities: isolating untrusted file processing pipelines, promptly patching underlying dependency vulnerabilities, tightening the trust scope of federated identity authentication, and managing AI agent credentials and permissions according to standards approaching privileged accounts. As AI agents further integrate into internal enterprise systems, the impact of a compromised AI account could spread downstream along the permission chain it is connected to.

Risk warning and disclaimerInvesting involves risk; please exercise caution. This article does not constitute personal investment advice and does not take into account the specific investment objectives, financial situation, or needs of individual users. Users should consider whether any opinions, views, or conclusions in this article are suitable for their specific circumstances. Any investment decisions made based on this information are at your own risk.