OpenAI Hacked Using Anthropic's AI Model
Researchers at Hacktron leveraged Anthropic's AI models to discover a vulnerability chain that allowed access to OpenAI's internal systems via a public support forum.
OpenAI Hacked Using Anthropic's AI Model
A HEIF-format photo uploaded to OpenAI's public support forum triggered an error in the site's image decoder. This allowed code execution on the forum, and through a second vulnerability in OpenAI's own login system, the attack reached the creation of a change request in OpenAI's internal GitHub.
The forum runs on Discourse, a ready-made engine used on a vast number of community sites. Discourse was still shipping with an old version of libheif, a library for decoding photos in HEIF format (used, among other things, on iPhones).
The bug in the library itself had already been fixed by libheif developers. However, the fix was not marked as security-related, so no one considered the update urgent.
Hacktron researchers uploaded a HEIF image and achieved execution of their own code on community.openai.com.
Then they discovered a second vulnerability in OpenAI's single sign-on system — the very "Login with OpenAI" button used by the forum.
Thanks to this, access to the forum could be turned into access to real ChatGPT and Codex accounts of users who had previously logged in through it. Among them were OpenAI employees.
And a ChatGPT account today is far more than just a chatbot. Through Codex, users connect Gmail, Outlook, Google Drive, Slack, and GitHub.
To prove that access actually works, researchers used one employee's account and, via Codex, created a harmless change request in OpenAI's internal repository.
According to them, they did not read any confidential code.
OpenAI fixed the login vulnerability approximately 14 hours after receiving the report and paid the researchers $6,500 under its bug bounty program.
The team claims that Anthropic Opus 4.8 found the bug in libheif, and Opus 5 helped turn it into a working attack method.
Researchers also state that the same chain of vulnerabilities affected Slack, Meta, GitHub Enterprise, Rails, Next.js, ImageMagick, and many other projects.
Why it matters
AnalysisThis incident highlights the growing capability of AI models to identify and exploit complex security vulnerabilities, posing new risks to major tech infrastructures.
Discuss in community
Share your questions and insights with developers
Related in Ecosystem
Practical guides, core terminology, and agent skills
AI Radar: GPT-6.1 Terra, Gemini 4 Carbon, Mistral Large 4 and OpenAI/Anthropic pricing changes
A roundup of recent AI news: new LLM releases, OpenAI and Anthropic subscription changes, world models, video generation, and research updates.
Four Resume Tips from OpenAI’s Head of Applied AI Development
Wulfie Bain, OpenAI’s head of applied AI development, shared four resume rules: keep it short, remove irrelevant details, highlight outcomes, and lead with the strongest achievements.
Claude Haiku (Fast Compact Models by Anthropic)
The most compact and fastest model in the Anthropic lineup, designed for lightning-fast responses, mass text classification, data extraction, and agent routing at minimal cost.
Claude Opus (Flagship AI Model by Anthropic)
The most powerful heavyweight model in the Anthropic family, designed for complex philosophical and scientific analysis, multi-layered text generation, and deep contextual understanding.