Hacktron used Anthropic’s Claude to exploit OpenAI bug-bounty targets
Claude Opus 5 helped turn a forum image bug into internal GitHub access, showing both AI’s offensive potential and new security expectations.
Security startup Hacktron AI used Anthropic’s Claude Opus 4.8 and 5 to help chain vulnerabilities that breached OpenAI employee ChatGPT/Codex accounts and internal GitHub access as part of OpenAI’s bug bounty program. The team exploited an outdated, vulnerable libheif image library in Discourse, which powers OpenAI’s community forum, to achieve remote code execution from a malicious HEIF profile image upload and then pivoted through a single sign‑on misconfiguration into OpenAI’s internal systems. They demonstrated access by sending a pull request from an employee Codex account to OpenAI’s private GitHub “Monorepo,” then halted and disclosed the issue to OpenAI and Discourse, which patched the bugs within about 72 hours; OpenAI paid a $6,500 bounty. Hacktron’s researchers say Claude Opus 4.8 could not reliably generate a working exploit, but Opus 5 — released the previous evening — was able to analyze memory data and produce weaponized code for the heap overflow within hours. The incident underscores Anthropic’s own claim that Claude now performs large portions of its AI R&D and highlights both the offensive power of off‑the‑shelf AI tools for exploit development and the need for strong isolation around SSO, third‑party services, and model‑assisted security workflows.
Why it matters
For security teams and developers, this is a concrete example of off-the-shelf AI turning a niche image parsing bug into a working exploit and internal repo access in hours, after a previous model version failed on the same task. That compresses the time and cost needed to weaponize vulnerabilities across multiple targets, and it comes as Anthropic says Claude already leads a significant share of its own AI R&D work, highlighting how model-assisted workflows are rapidly becoming standard on both sides of the security boundary.