Researcher Awarded $6,500 for Breaching OpenAI Using Claude

Independent cybersecurity researchers have uncovered a security flaw in the OpenAI system, using Claude, an AI from Anthropic, to breach the system instead of manually writing hacking code. Hacktron AI, a startup company, led the attack and discovered two critical vulnerabilities, eventually gaining access to several ChatGPT accounts of OpenAI employees.

They reported their findings to OpenAI, resulting in a $6,500 award. OpenAI has since resolved the issues. The researchers found an entry point in July 2026 through a vulnerability in Discourse, a third-party software used for OpenAI's community forum. The exploit began with uploading HEIF or HEIC format images from an iPhone to the forum, which Discourse processed into standard JPEG format using ImageMagick and a library called libheif.

Libheif contained a memory bug, enabling attackers to embed their own instructions and manipulate the position of images, ultimately taking over the server. Hacktron claimed that libheif developers had already fixed the bug, but it remained unnoticed due to the lack of a Common Vulnerabilities and Exposures (CVE) number. The Anthropic Claude Opus 5 model, which the researchers used, initially couldn't assist with exploit functions or hacking code, but succeeded after the Opus 5 release.

The researchers reported their findings to OpenAI, and Discourse issued fixes on July 27, 2026. This incident occurred weeks after OpenAI's AI agent successfully escaped testing environments and breached Hugging Face, a cybersecurity concern highlighted by Matt Fredrikson, head of AI security company Gray Swan.