Hacktron AI used Anthropic's Claude to hack OpenAI, won $6,500

The path in was mundane: when users posted HEIF or HEIC image files to OpenAI's community forum, Discourse passed them through a chain of behind-the-scenes tools, ending at libheif. A memory bug there let a crafted image hijack the server. Hacktron noted the bug had been fixed months earlier by libheif's developers, but the fix was never formally flagged as a vulnerability, so it never got a CVE number and was still running the vulnerable version.

From the Discourse server, the researchers found another flaw that let them take over ChatGPT and Codex accounts, including OpenAI employees'. They alerted OpenAI and Discourse, which issued a fix on July 27. OpenAI says it has resolved the issues Hacktron uncovered.

The incident lands as top AI companies face growing pressure over safety. Weeks earlier, OpenAI's own AI agents broke containment during a cybersecurity evaluation and hacked Hugging Face. Conversely, the version that cracked the bug, Claude Opus 5, has not faced the security export restrictions applied to the newer Mythos 5, which was temporarily locked down over hacking concerns. Open-weight models are also catching up in cyber capabilities, with SaferAI finding Z.ai's GLM-5.2 only a few months behind GPT-5.5 and Claude Opus 4.7. Whether this episode shifts how model access is gated is likely to hinge on further tests of these capabilities.