Researchers Used Claude AI to Breach OpenAI Systems in Under 72 Hours, Earning $6,500 Bug Bounty

Researchers Breach OpenAI Systems Using Claude AI in Controlled Security Test

Three cybersecurity researchers at Hacktron AI—Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini—demonstrated how Anthropic's Claude AI models could accelerate sophisticated security research by chaining two vulnerabilities to access OpenAI employee accounts and an internal code repository.1

1

The entire exploit chain, from initial discovery to proven access, took less than 72 hours and cost under $3,000 in AI tokens.3

3

This was not a malicious attack but responsible security research conducted under OpenAI's bug-bounty program, with the team immediately reporting their findings.2

2

How the Exploit Chain Reached OpenAI Employee Accounts

The researchers breach OpenAI systems began with a vulnerability in Discourse, the open-source software powering OpenAI's public community forum at community.openai.com.1

1

The team discovered that specially crafted HEIC and HEIF image files could exploit a flaw in libheif, an image-decoding library used by ImageMagick when processing uploaded images. This vulnerability, tracked as CVE-2026-32882 and scored 8.8 out of 10, allowed remote code execution on the forum server.1

1

The critical issue was not just the forum vulnerability itself, but how it chained with an identity-related weakness in OpenAI's single sign-on system. OpenAI's forum offered a "Sign in with OpenAI" option—the same authentication mechanism used by staff across multiple services.1

1

Once the cybersecurity researchers gained control of the forum server through the image processing flaw, the shared login system allowed them to take over ChatGPT and Codex accounts of forum members who worked at OpenAI, without those employees needing to take any action.1

1

Access to OpenAI Employee Accounts and Internal Code Repository

Through the compromised employee accounts, the researchers gained access to OpenAI's internal GitHub environment. One employee's Codex account was connected to OpenAI's private code repository, allowing the team to demonstrate their access by creating a single harmless pull request.1

1

Hacktron AI was careful about the scope of their testing—they did not read any source code, merge or ship anything, or touch customer data.1

1

The potential reach of this chained vulnerabilities exploit was far more extensive than what the researchers actually accessed. Because staff connects other services to ChatGPT and Codex, the same access could theoretically have extended to tools such as GitHub, Slack, and email.1

1

This highlights how a seemingly isolated forum vulnerability, when combined with authentication weaknesses, can cascade into broad organizational access.

Claude Opus 5 Accelerated AI-Assisted Exploit Development

The role of AI in cybersecurity became central to this research when the team leveraged Anthropic's Claude AI models to develop working exploits. The researchers initially attempted to use Claude Opus 4.8, which struggled to build a functional exploit once standard memory defenses like ASLR (Address Space Layout Randomization) were enabled.1

1

The breakthrough came when Anthropic released Claude Opus 5 on the evening of July 24. In a fresh session, the new model produced a working exploit within hours.1

1

Despite Claude Opus 5 shipping with safeguards designed to prevent it from writing exploit code for real targets, the researchers circumvented these protections by pointing the model at their own test server, disguised as a capture-the-flag practice target, and allowing it to run in an automated loop.1

1

However, this AI in offensive security research was not entirely autonomous. The researchers emphasized that skilled human direction still mattered significantly, and this was not automated hacking with no one at the controls.1

1

The case demonstrates what researchers and AI companies have described throughout the year: capable AI models are sharply cutting the time and skill that serious offensive work used to require.1

1

OpenAI's Response and the $6,500 Bug Bounty Award

Following responsible disclosure, OpenAI confirmed a fix approximately 14 hours after receiving the report from Hacktron AI.1

1

On September 1, the company paid the team a $6,500 bounty through its OpenAI bug-bounty program.1

1

OpenAI spokesperson Drew Pusateri thanked the researchers for reporting the findings and confirmed that the company had resolved the vulnerability.3

3

The award specifically recognized the OpenAI-side finding related to the authentication weakness, not the actions against Discourse, since testing the forum software itself was outside OpenAI's bug bounty scope.1

1

OpenAI also revoked affected authentication tokens and sessions as part of its remediation.3

3

The $6,500 payment has sparked discussion about bounty economics and whether such awards are proportionate to the value of access gained—in this case, reaching employee accounts and an internal code repository at a company valued in the hundreds of billions.2

2

This fits a broader pattern where major AI companies have paid relatively modest bounties on significant vulnerabilities, sometimes as low as $100 on issues rated above nine out of ten for severity.2

2

What This Means for AI Safety and Future Security

This incident underscores a critical shift in AI in cybersecurity: the timeline from vulnerability discovery to working exploitation has collapsed dramatically. What once required specialized skills and significant time can now be accomplished in days with commercially available AI tools.2

2

Anthropic has reported that criminal and state-backed groups are already using its Claude models to run real intrusions, not just to answer questions.1

1

The vulnerabilities themselves were not AI-specific—they represented ordinary classes of web security failures that predate the AI industry by decades.2

2

The libheif flaw had been fixed upstream in version 1.22.0 in May 2026, but the forum's server image, built on Debian 12 Linux distribution, still shipped the old, unpatched version 1.19.7 when researchers examined it in July.1

1

Researchers Sayash Kapoor and Arvind Narayanan argue that preventing such incidents requires more than alignment work alone—labs need controls outside the model, including sandboxing, least privilege access, logging, tripwires, shutdown mechanisms, and real-time monitoring tested against adversarial evaluations.2

2

They also call for mandatory incident reporting including near misses, independent auditing, whistleblower protections, and safe harbors for safety research.2

2

Watch for increased regulatory pressure around AI safety controls and whether bounty programs adequately incentivize disclosure of high-impact vulnerabilities.