Three researchers from startup Hacktron AI used Anthropic’s Claude Opus 5 to breach OpenAI’s internal systems, chaining together two security vulnerabilities and gaining a path into the company’s private GitHub environment. The full exploit took less than 72 hours from initial discovery, and OpenAI paid the team a $6,500 bug bounty for responsible disclosure.

The story matters well beyond the “AI versus AI” headlines. It shows that AI models are now capable enough to do real, sophisticated security research — the kind that previously required experienced human specialists. For business leaders building on AI infrastructure today, the implications run deep.

How the Hack Worked

The Hacktron team — Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini — started at community.openai.com, OpenAI’s public discussion forum. The forum runs on Discourse, and they found that image uploads in HEIC and HEIF formats were being routed through ImageMagick, which uses a library called libheif. That library had a heap buffer overflow vulnerability.

That was the first crack. The second one was in OpenAI’s single sign-on setup: session tokens issued by the forum stayed valid across ChatGPT and Codex, OpenAI’s coding agent. With the image exploit granting initial access and the SSO flaw letting them move laterally, the team was able to take over employee accounts and reach internal company software.

Claude’s role in this was the critical detail. The team noted in a public post that Opus 4.8, the previous model, had struggled to produce a working exploit across multiple sessions. Within hours of Claude Opus 5 becoming available, they fed it the same problem and it succeeded.

OpenAI says it has resolved both vulnerabilities. The breach was part of an authorized bug bounty program, not a criminal attack.

What This Means for Business

This isn’t a story about OpenAI being uniquely vulnerable. It’s a story about what AI models can now do as offensive security tools — and what that means for any organization running web-facing applications.

AI-assisted exploits are here now. Security researchers have been using AI to speed up vulnerability research for a while, but this demonstrates that a small team with strong prompting skills can use a frontier model to produce a working exploit for a real target in under three days. The barrier to entry for sophisticated attacks is dropping.

Your infrastructure is the same infrastructure OpenAI uses. OpenAI’s forum was running Discourse, a common open-source platform. ImageMagick is used everywhere. SSO misconfigurations are routine. The specific vulnerabilities chained here were not exotic.

The model capability jump is material. The fact that Opus 4.8 failed but Opus 5 succeeded on the same problem is worth paying attention to. It suggests that as frontier models improve, the class of exploits they can help produce expands with them.

Enterprise AI deployments have an expanding attack surface. Companies deploying AI agents that take actions — browsing the web, reading files, executing code, managing SaaS integrations — are adding new surfaces that traditional security tools weren’t designed to audit.

What You Should Actually Do

This story is a useful prompt for a security review conversation you may have been deferring:

Audit your SSO token lifetimes. The session token vulnerability here was a configuration issue, not a platform flaw. Most organizations have some version of these misconfigurations in place.

Treat AI-accessible services as higher-risk. Any endpoint that an AI agent can reach and interact with is now part of your threat model in a way it wasn’t two years ago.

Don’t assume “we use a big vendor’s platform” means “we’re safe.” The attack surface was community.openai.com — a platform running entirely standard off-the-shelf software. What matters is configuration, patching cadence, and how well your different systems are isolated from each other.

Think about your AI agents’ permissions. If an AI agent operating inside your organization has write access to your internal GitHub, your CRM, or your financial systems, and that agent’s session tokens are not tightly scoped, you have the same structural vulnerability as OpenAI did here.

The good news is that responsible disclosure still works. Hacktron found real problems, reported them, and OpenAI fixed them. The $6,500 bounty is fairly modest for what was found — most security researchers will note that a path into a major AI company’s internal source code repository is worth considerably more on the open market. The fact that the team went through proper channels is worth acknowledging.

The Bigger Picture

The research community and enterprise buyers are watching the same trend: AI models are becoming general-purpose tools not just for productivity, but for technical work that requires deep expertise. Security research is one of the most demanding of those domains, and Opus 5 just demonstrated it can operate effectively there.

For organizations evaluating or already running AI agent deployments, this is a good moment to revisit your security posture — not because your AI vendors are uniquely dangerous, but because the broader ecosystem of AI capabilities is now sophisticated enough to find and exploit the configuration gaps most organizations have tolerated for years.

The Hacktron team found these vulnerabilities because they were looking for them. So are others.

---

Enterprise DNA helps organizations build AI strategies that include governance, security, and responsible deployment. Learn more about Omni Advisory — fractional AI advisory for business leaders navigating decisions like these.