Security researchers at Hacktron recently leveraged Anthropic’s Claude to breach OpenAI accounts and gain access to an internal code repository within 72 hours. The researchers found vulnerabilities in OpenAI’s identity infrastructure and image-processing pipeline, enabling them to compromise multiple employees’ ChatGPT and Codex accounts.
The attack began with an investigation into the image-upload pipeline used by OpenAI’s Discourse community forum, where a flaw in the processing of HEIC and HEIF files through ImageMagick and libheif allowed for malicious image uploads. Anthropic’s Claude Opus 4.8 identified a heap buffer overflow in the libheif package, leading to code execution when ASLR was disabled.
Despite initial challenges in exploiting the vulnerability reliably, Anthropic released Opus 5, which enabled the researchers to develop a working exploit for both ARM64 and x86-64 architectures. By July 25, the team had successfully executed code through a malicious image upload.
The researchers then tested Claude’s capability to reproduce the attack against a remote environment autonomously. After some adjustments to the test environment, Claude successfully replicated the exploit against the remote system, allowing the researchers to gain administrative access to OpenAI’s community forum.
Subsequently, the researchers used a weakness in OpenAI’s single-sign-on system to escalate their access to ChatGPT and Codex accounts. One compromised Codex account was linked to OpenAI’s GitHub organization, providing the researchers with entry into the company’s internal software environment.
Hacktron disclosed the vulnerabilities to OpenAI, which promptly addressed the identity-side flaw and rewarded the company with a $6,500 bounty. The breach highlighted the speed at which AI is streamlining exploit development processes, reducing the reliance on specialized expertise.
However, the operation still required skilled human researchers to guide the AI models effectively. As AI-powered coding agents like Codex and Claude Code become more prevalent in corporate workflows, the potential blast radius of a compromised account increases, posing significant security risks.
The breach underscored the need for robust security measures as AI lowers the barrier to developing sophisticated exploits. OpenAI and Discourse took steps to tighten access controls and implement additional safeguards around their systems following the disclosure of the vulnerabilities.
In conclusion, the OpenAI breach serves as a wakeup call for organizations to enhance their cybersecurity measures in the face of evolving threats posed by AI-powered exploits.