Security researchers at Hacktron AI say they used Anthropic’s Claude Opus 4.8 and 5 to break into OpenAI employee accounts, then reach into the company’s software systems.
The team was working through OpenAI’s bug-bounty program and was paid $6,500 after reporting the issues, according to the sources. OpenAI says it has resolved the problems.
The entry point was not some cinematic zero-day in a giant model stack. It was a forum. The researchers found a flaw in Discourse, the third-party software powering OpenAI’s community forum, by abusing the way the system processed HEIF image files.
From there, the path got ugly fast. Hacktron says it chained together two vulnerabilities, got into OpenAI employee ChatGPT accounts, and used one employee’s Codex connection to access OpenAI’s GitHub organization. The group said it did not fully read internal code in OpenAI’s Monorepo, but it did send a pull request from an employee account to prove the access worked.
The researchers said Claude Opus 4.8 could not produce a working exploit at first. Then Anthropic released Opus 5. Within hours, Hacktron says, the same problem turned into a successful attack.
That is the part that should make every security team wince. The demo is not the product, and the benchmark is not the threat model. Here, a three-person team used off-the-shelf AI tools, a corrupted image file, and forum software to punch through a company that builds frontier AI systems.
Hacktron said its project took only one or two days to adapt to different companies and used less than $3,000 in tokens. Mohan Pedhapati, Hacktron’s CTO, told The Wall Street Journal, 'I don’t think we are as strong as Chinese threat actors… We’re just three guys with Claude and Codex subscriptions.'
Matt Fredrikson, CEO of Gray Swan, told TechCrunch, 'For $200 a month, anyone can use these tools and hack into a company like OpenAI.'
OpenAI said it thanked the researchers for contacting it and fixed the issues. Discourse also issued a fix. But the bigger story is not the bounty payout. It is how much damage a cheap toolchain can do when the weakest link is the boring software around the model.
That is the real warning for the platform economy: the attack surface is not just the algorithm. It is the whole walled garden, from image parsers to forums to account links. And as AI gets better at chaining steps together, the cost of finding those cracks keeps falling.
