Three People + Claude Opus 5 Breached OpenAI in 72 Hours — for a $6,500 Bounty
The party that broke into OpenAI wasn't another big lab's red team — it was three researchers plus an AI. And that AI came from OpenAI's chief rival.
Three key facts
On September 18, multiple outlets reported that security researchers at the startup Hacktron AI successfully breached OpenAI's systems, using Anthropic's Claude Opus 5 throughout — less than 72 hours from finding the bug to a working exploit chain. The entry point was a heap buffer overflow (CVSS 8.8) in libheif, the image-processing library used by OpenAI's community forum, which runs on Discourse — a single corrupted image file was enough to get remote code execution on the forum server.
The privilege-escalation path stings more: from the forum server they broke through a flaw in OpenAI's single sign-on (SSO) authentication, taking over one employee's ChatGPT and Codex accounts; that Codex account was linked to OpenAI's GitHub organization, and through it the researchers reached OpenAI's internal GitHub environment. As proof of concept, they generated a benign pull request inside an OpenAI internal repository.
OpenAI patched the flaws back on July 28 and paid Hacktron AI a $6,500 bounty under its bug bounty program. The real value of this chain isn't the bounty — it's that it demonstrated a trend: AI agents holding broad credential access are turning internal infrastructure into a new attack surface.
Wang Dou's Take
The drama here hides in the casting: the AI doing the hacking was Anthropic's Claude, the target was OpenAI — a knife handed over by the rival, driven into its own front door. Competition aside, when the standard kit for "breaching a frontier lab" becomes "one AI assistant + 72 hours," the cost structure of security has been rewritten. It used to take stacked red teams, a planted insider, and a wait for luck; now three researchers can run the exploit chain in the time it takes to order takeout.
The number $6,500 is the one that deserves framing. It isn't OpenAI being stingy — it's the honest list price of the bug bounty system: on the bounty sheet, a complete exploit chain that pierces SSO and reaches internal GitHub may sit in the same budget tier as finding one XSS popup. Attackers have used AI to drive the cost of finding bugs to near zero, while defenders' bounty tables are still stuck in the manual-labor era. That pricing system is destined to be shamed by its own payout slips sooner or later.
The line worth remembering: what got breached was never the model — it was the scaffolding around the model. libheif, Discourse, SSO, a Codex account — OpenAI's strongest AI couldn't guard an ordinary forum image. The more autonomous the AI, the more credentials, the bigger the attack surface. That's not a bug in the security team's setup; it's the design-time original sin of the agent era.
Source: Cybernews · Cyber Security News · Metacurity