Researchers Used Anthropic’s Claude to Hack OpenAI Employee Accounts

Security researchers have demonstrated how artificial intelligence can be used to uncover and exploit vulnerabilities in the systems of one of the world’s leading AI companies, after using Anthropic’s Claude to gain access to OpenAI employee accounts.

The research was carried out by three members of security company Hacktron as part of responsible security testing. The team chained together vulnerabilities affecting OpenAI’s infrastructure and eventually gained access to the ChatGPT and Codex accounts of OpenAI employees.

The researchers were able to demonstrate that one compromised employee account had access to OpenAI’s internal GitHub organisation. Rather than accessing or downloading internal source code, the researchers used the account to create a harmless pull request, demonstrating the level of access they had obtained.

Attack began with an image upload

The initial route into the environment involved OpenAI’s community forum, which is powered by the third-party Discourse platform.

The researchers discovered that certain HEIF image uploads could eventually be processed by ImageMagick and the libheif image-processing library. A memory corruption vulnerability in libheif provided a route towards executing code on the underlying server.

According to the researchers, the underlying libheif issue had previously been fixed by its developers, but had not been formally identified as a security vulnerability and therefore did not have a CVE assigned to it. This meant the vulnerable component could remain in use by software relying on it.

The researchers initially attempted to develop an exploit using Claude Opus 4.8. However, they said the model struggled to produce a working exploit against the particular configuration they were testing.

The situation changed following the release of Claude Opus 5. The researchers said the newer model was able to help produce a working exploit, allowing them to obtain code execution on the Discourse server.

From forum access to employee accounts

Once the researchers had control of the forum environment, they discovered that OpenAI’s authentication arrangements created another potential route.

OpenAI’s community forum offered a “Sign in with OpenAI” option. Because employees also used the same identity infrastructure with ChatGPT and Codex, the researchers were able to use their position within the compromised environment to target accounts belonging to OpenAI employees.

The result was access to multiple employee ChatGPT and Codex accounts.

The researchers warned that the potential consequences could have been considerably broader because ChatGPT and Codex accounts can be connected to other services and corporate resources. They specifically identified services such as GitHub, Slack and email as examples of systems that could potentially be exposed depending on an account’s permissions.

However, the researchers said they deliberately limited their testing and did not access or download OpenAI’s internal source code.

Instead, they used an employee’s Codex account, which was connected to OpenAI’s GitHub organisation, to create a pull request in the company’s internal repository. The demonstration was then stopped.

Entire process took less than 72 hours

One of the most significant aspects of the incident was the speed at which the researchers were able to move from discovering the vulnerabilities to demonstrating access to OpenAI’s internal environment.

Hacktron said the process took less than 72 hours, with the researchers themselves providing the human oversight while AI models assisted with parts of the security research and exploit development.

The researchers were subsequently paid $6,500 by OpenAI through its bug bounty programme.

OpenAI said the award related to the OpenAI-side security finding and not the researchers’ testing of the Discourse-hosted community forum, which was outside the scope of its bug bounty programme.

OpenAI fixed the issue within approximately 14 hours of receiving the report, according to Hacktron. Discourse also released a fix which introduced additional sandboxing for image processing and published security guidance relating to the vulnerability.

AI changes the economics of vulnerability research

The incident highlights a growing concern within the cybersecurity industry: increasingly capable AI models can reduce the amount of specialist knowledge and time required to investigate complicated vulnerabilities.

Hacktron said that work which previously could have required a well-resourced security team and months of effort can potentially be compressed into days when AI assistance is available.

Importantly, the incident was not an entirely autonomous attack. Human researchers selected targets, investigated the systems, directed the AI models and decided how far the testing would go.

Nevertheless, the ability of a commercially available AI model to assist researchers in turning a low-level software vulnerability into a practical attack demonstrates how the threat landscape is changing.

For organisations, the incident also illustrates the risks created when third-party software, identity systems and AI-enabled services are connected together. A vulnerability in an image-processing component used by a public forum ultimately provided a route towards accounts with access to much more sensitive corporate resources.

The researchers’ work therefore serves as a reminder that security boundaries need to be considered across entire technology ecosystems rather than individual applications.

As AI systems become increasingly capable at analysing code and developing exploits, organisations may need to assume that attackers can investigate vulnerabilities significantly faster than they could in the past.