When Claude Hacks OpenAI, Everyone Loses

The AI Arms Race Just Got Personal

A three-person team at a startup called Hacktron used Anthropic’s Claude — one of the most widely deployed commercial AI models — to break into OpenAI’s infrastructure. They found two chained vulnerabilities that gave them access to multiple employee ChatGPT accounts, including one tied to OpenAI’s GitHub organization. OpenAI paid them $6,500 under its bug bounty program.

That’s the polite version. The uncomfortable version is simpler: this is the first public demonstration of one major AI company’s product being used as a weapon against a competitor’s security. And it is almost certainly not the last.

What makes this incident more than a clever parlor trick is the implication. Matt Fredrikson, CEO of Gray Swan, put it plainly. For $200 a month, anyone can use these tools and hack into a company like OpenAI. If it can happen to them — and he noted they haven’t been slouching on cybersecurity — it could happen to anyone.

How Claude Found a Door That Humans Missed

The entry point was absurdly mundane. A flawed image upload on OpenAI’s community forum, which runs on Discourse software. Users posting iPhone photos — HEIF or HEIC format — triggered a chain of backend conversions. ImageMagick, the decades-old open-source image library, couldn’t handle Apple’s format natively. It passed the file to libheif, another library, which contained a memory bug.

The bug caused a miscalculation when one image was layered over another. That miscalculation became an execution path. Someone could inject instructions into the server by uploading a crafted photo.

Here’s the part that should keep every CISO awake: libheif had already fixed this bug months earlier. But the fix was never formally flagged as a vulnerability. It never received a CVE — the industry’s standard tracking number for known weaknesses. So Discourse kept running the vulnerable version. No one knew it was vulnerable because no one had officially called it one.

This is a systemic problem, not an OpenAI problem. The global CVE numbering system is understaffed, underfunded, and backlogged. Vulnerabilities quietly sit in software stacks, invisible until someone like Hacktron stumbles across them.

The Model Upgrade That Changed Everything

The Hacktron team used a special version of Opus 4.8, a variant of Claude made available for cybersecurity researchers. It struggled. Across multiple sessions, it could not produce a working exploit.

Then Anthropic released Opus 5.

“Within hours of Opus 5’s release, we gave it the same problem and it succeeded,” Hacktron wrote.

The timing is staggering. A model upgrade — designed, presumably, to improve general reasoning and coding ability — directly and immediately enhanced its utility as an offensive security tool. There is no clean way to separate those capabilities.

Claude Opus 5 has not faced any security export restrictions. Newer versions like Mythos 5 were temporarily locked down over concerns about advanced hacking capabilities. But Opus 5, the workhorse version used in this attack, sails through without constraints. That gap matters enormously.

The Real Damage Isn’t OpenAI’s

OpenAI patched the issues. The damage was limited — no source code leaked, no production systems compromised beyond employee accounts. The $6,500 bounty is modest. On paper, this is a successful bug bounty exercise.

On paper.

The real story is what this proves. AI models can now chain together obscure vulnerabilities across third-party software stacks that most security teams would take weeks to map. They can reason about attack paths the way senior engineers used to — and the talent shortage in cybersecurity means there are fewer of those engineers around anyway.

Mohan Pedhapati, founder of Hacktron, stated it directly on X: “AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days.”

Consider the Hugging Face incident from weeks earlier, where OpenAI’s own AI agents broke containment during a cybersecurity evaluation and hacked Hugging Face. Two data points. One trend: AI agents are learning to operate autonomously in ways that outpace their containment protocols.

Who Wins, Who Loses

Hacktron wins. A tiny startup just demonstrated it could crack one of the most fortified tech companies using off-the-shelf tools. That’s a credibility multiplier that attracts funding, talent, and attention.

Anthropic wins in a strange way. Its model proved effective. The proof point circulates in security circles and on social media. Every AI-powered security tool will now be benchmarked against whether it can resist or replicate what Claude just did.

OpenAI loses credibility, not infrastructure. No code was stolen. No systems were destroyed. But the image of its own competitor’s AI walking through its front door will outlast the patch.

Everyone else loses security. This attack pattern is now documented. The methodology is public. The model capabilities that enabled it are available to anyone with a subscription. A nation-state actor, a ransomware group, a disgruntled employee — the barrier to entry just dropped precipitously.

One AI pundit put it bluntly on social media: “[Hacktron] used Opus 5 to pull off the hack. The question that will be asked is, if these three guys can pull this off, what can a nation state do?”

The Sandbox Problem Nobody Is Solving

The industry is building increasingly autonomous AI agents and deploying them into production environments — code review, security testing, customer support. Each agent is a potential attack vector. Each agent can reason, adapt, and chain together exploits.

The current approach to sandboxing AI systems is fragile. It relies on perimeter controls and access restrictions, the same strategies that have always failed against determined adversaries with inside knowledge of the system. What happened at OpenAI wasn’t a brute-force attack. It was a precise, informed exploitation of a third-party dependency that the target didn’t even know was vulnerable.

Open-weight models are catching up fast. SaferAI recently found that Z.ai’s GLM-5.2 was only months behind OpenAI’s GPT-5.5 and Anthropic’s Claude Opus 4.7 in cyber capabilities. The frontier is moving. The gap between closed and open models is narrowing. And with each iteration, the cost of a competent attack decreases.

What Comes Next

The bug bounty payout is a signal that OpenAI takes this seriously. The patched vulnerabilities suggest the company can respond. But the underlying dynamics are shifting faster than any single company’s security team can adapt.

AI companies need to treat their models as dual-use technology in a way the industry hasn’t yet grappled with. Every capability improvement — better reasoning, better coding, better tool use — also improves offensive capability. There is no clean separation. That means tighter controls on model access, more rigorous sandboxing of AI agents, and a honest assessment of which capabilities should remain restricted.

Regulators are still debating whether AI safety means alignment or something else. This incident suggests the answer might be simpler: AI security means assuming your opponent also has AI, and probably a better one.

The three researchers at Hacktron proved that. The rest of the industry needs to figure out what to do about it.