A three-person security team demonstrated how rapidly artificial intelligence is changing the economics of cyberattacks, using Anthropic‘s Claude models to help develop an exploit chain that compromised OpenAI employee ChatGPT and Codex accounts and ultimately reached the company’s private GitHub environment. The July attack began with a vulnerability in the image-processing software used by OpenAI’s Discourse-powered community forum and escalated through a weakness in OpenAI’s single-sign-on system. The researchers, operating as white-hat security researchers, said the process took less than 72 hours and culminated in a harmless pull request to an internal OpenAI repository rather than an attempt to steal proprietary code. OpenAI reportedly fixed its portion of the vulnerability roughly 14 hours after notification and ultimately paid a $6,500 bounty. The larger concern is not simply that OpenAI was penetrated, but that increasingly capable AI systems may dramatically reduce the time, manpower, and specialized expertise historically required to turn obscure software vulnerabilities into practical exploits.
Key Takeaways
- Researchers chained a remote-code-execution vulnerability involving the libheif image decoder with an OpenAI single-sign-on weakness, allowing a malicious image uploaded through the community forum to become an avenue for compromising employee ChatGPT and Codex accounts.
- Claude substantially accelerated exploit development. The researchers reported that Claude Opus 4.8 struggled to produce a reliable exploit with normal protections enabled, while the newly released Claude Opus 5 succeeded within hours, illustrating how rapidly improving AI capabilities can lower the practical barriers to sophisticated offensive cybersecurity work.
- The researchers stopped after demonstrating access through a harmless pull request rather than examining sensitive internal code. OpenAI narrowed permissions, revoked affected tokens and sessions, and reportedly fixed its SSO vulnerability roughly 14 hours after the initial submission; Discourse separately patched its image-processing vulnerability and strengthened sandboxing.
In-Depth
The breach of OpenAI by a three-person security team provides a sobering demonstration of how quickly artificial intelligence is altering cybersecurity. Researchers discovered that OpenAI’s community forum, operated using Discourse, exposed an image-processing pathway involving libheif. A malformed HEIF image could exploit the vulnerable component and produce remote code execution. Discourse subsequently classified the vulnerability as high severity, with a CVSS score of 8.8.
That vulnerability alone, however, did not produce the most consequential result. The researchers combined it with a weakness in OpenAI’s single-sign-on infrastructure. Once the forum was compromised, authentication credentials could provide access extending into ChatGPT and Codex accounts. One compromised employee account had Codex connected to OpenAI’s private GitHub organization, allowing the researchers to demonstrate their access by directing Codex to create a harmless pull request inside an internal repository.
The most consequential aspect may be Claude’s role. Hacktron reported that Claude Opus 4.8 helped identify and develop the vulnerability but initially struggled to defeat protections such as address-space layout randomization. After Claude Opus 5 became available, the newer model reportedly produced a functioning exploit within hours. Human expertise remained necessary, but AI sharply increased what a tiny team could accomplish.
That changes the cybersecurity equation. Complexity once provided organizations with an imperfect but meaningful defensive advantage because converting obscure vulnerabilities into dependable exploits demanded considerable expertise, manpower, and time. Advanced AI threatens to erode that advantage. The same technology that enables defenders to discover vulnerabilities faster can give attackers comparable leverage. Security policies therefore must increasingly assume that sophisticated exploitation capabilities will become cheaper, faster, and available to far smaller groups than in the past.
Sources
- https://www.hacktron.ai/blog/hacking-openai
- https://github.com/discourse/discourse/security/advisories/GHSA-vhm9-85gw-x335
- https://www.theverge.com/ai-artificial-intelligence/997444/openai-hack-claude-heif-heist
- https://venturebeat.com/security/openai-hacked-by-small-team-of-white-hat-security-researchers-using-anthropics-claude-opus-5
- https://www.tomshardware.com/tech-industry/cyber-security/hackers-breach-openai-using-claude-tools-gaining-access-to-employee-accounts-and-the-companys-internal-codebase-initiating-a-harmless-pull-request-as-proof-of-the-hack