Researchers used Claude to hack OpenAI employees' ChatGPT accounts

Talk about your competitor getting through the door.

Security researchers used Anthropic's Claude to help hack into OpenAI employees’ ChatGPT accounts.

A trio of bug hunters researching frontier AI labs’ security weaknesses chained two vulnerabilities to take over multiple OpenAI employees’ ChatGPT accounts, then used that access to demonstrate they could reach an internal OpenAI repository by opening a harmless pull request.

The entire timeline, from initial discovery to accessing OpenAI’s repo, took less than 72 hours and earned the researchers a $6,500 reward from OpenAI’s bug bounty program on Bugcrowd.

“Until two months ago, any user or OpenAI employee logging into OpenAI’s own help forum (community.openai.com) could have had their ChatGPT and Codex accounts taken over,” Hacktron researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini said in a writeup about their research.

“Since people can connect various services to Codex and ChatGPT, the scope of what we could theoretically access was huge, including GitHub, Slack and emails.” And, in a poetic twist, they used rival AI giant Anthropic’s Claude models to develop the exploit.

Claude has shown a propensity to hack organizations without human guidance, as have OpenAI's models.

The team gained initial entry on July 25 via OpenAI’s community forum.

The forum runs on Discourse, which typically uses FastImage to perform image checks.

However, since FastImage didn’t support HEIF files in the affected setup, HEIF images uploaded to Discourse passed through ImageMagick, which used libheif to process them before converting them to another image format.

“That exposed the underlying libheif parser directly to attacker-controlled files,” the researchers wrote.

Using Claude Opus 4.8, the trio found a heap buffer overflow flaw in the libheif library and attempted to use that model to develop a remote code execution (RCE) attack, but this didn’t work on Discourse’s default configuration.

But then, Anthropic released Claude Opus 5.

The bug hunters used the newer model to generate an exploit script, and achieved RCE on OpenAI’s instance.