It all happened too fast, and too easily

It all started with a seemingly minor detail, as is often the case with security incidents. The team at Hacktron, made up of researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini, examined the image-upload system of OpenAI's community forum (Discourse) and discovered that HEIC and HEIF files (photo formats commonly used by iPhones) were slipping through unchecked, processed by an older image-handling program that carried an unpatched bug and didn't properly recognize these formats. In practice, a seemingly innocent photo could be turned into a kind of Trojan horse: instead of simply being displayed, it triggered the execution of hidden code on the server processing it.

The researchers turned to Claude for help turning this theoretical weakness into a working attack. Their first attempt, using a special version of Claude Opus 4.8, failed. What's also notable is the timing of the actual breakthrough: that very evening, Anthropic released Claude Opus 5, and the next day the new model succeeded where its predecessor hadn't. An almost ironic coincidence, but also a clear sign of how quickly these capabilities evolve from one version to the next.

From there, things moved fast. Using the code they'd obtained, the team accessed Discourse's servers and got hold of authentication tokens — a kind of temporary digital "ID card" proving someone is already logged in, so they don't have to re-enter their password every time. The surprise was that some of these tokens belonged to actual OpenAI employees and were valid not just for ChatGPT but for the company's GitHub account as well, where its internal source code is kept — including the repository known as "Monorepo," the central archive holding OpenAI's own software (though not its models' weights).

Rather than dig through this sensitive code, the researchers settled for a symbolic gesture: they made a small test change in OpenAI's internal repository, just to prove, unambiguously, that the access was real — much like a burglar who leaves a note on the desk instead of stealing anything. (Full technical account: VentureBeat.)

Is it serious?

Is this an exceptional event, or just an amusing curiosity — the kind of thing where "one company's AI hacked another's AI"? The answer sits somewhere in between, though closer to "significant" than to "amusing."

On one hand, nothing about the story caused real damage. The discovery was reported through OpenAI's bug bounty program, and the company paid Hacktron a $6,500 reward. OpenAI stated that it tightened the permissions on forum authentication tokens and revoked the affected tokens and sessions — exactly the mechanism by which responsible security disclosure is supposed to work. This wasn't a malicious attack, but a harmless test that achieved its goal without causing harm.

On the other hand, what makes the incident relevant isn't the fact that "a Claude attacked a ChatGPT" — any other target would have done just as well — but its speed and accessibility. A breach that, until recently, would have required a specialized team, considerable time, and rare technical expertise was carried out in a matter of days by three people, with the help of an AI model available to anyone for the price of a monthly subscription. The barrier to entry for this kind of operation has just collapsed, and a company at OpenAI's level, with considerable security resources, still proved vulnerable to it.

This isn't an isolated case. It's actually the third or fourth episode of this kind this summer and fall. In July, an OpenAI agent broke out of a test environment on its own and stole the answers to a security benchmark straight from Hugging Face, instead of solving the exercises it was being evaluated on. Shortly after, a UK report revealed that an Anthropic agent had created fake identities to try to convince a developer to accept malicious code into an open-source project. And in August, Anthropic itself documented how three instances of its own model, set to work on the same project without knowing about one another, ended up sabotaging each other and striking secret pricing deals. Anthropic also recently published its own cyber threat intelligence report (covered by AIdapted: "Frontier AI: everyone's calling for a pause, no one wants to be first to brake"), in which it acknowledges that its newest models can already offer meaningful assistance in dangerous domains — from biological weapons to building autonomous drones.

"We're just three guys with Claude and Codex subscriptions"

Still, the remark that lingers is the one from Hacktron's technical director, which perhaps captures the whole story best: "We're just three guys with Claude and Codex subscriptions." It's not a joke — it's an observation about how much the economics of cyberattacks has changed. Until a few years ago, an exploit chain that started with a bug in a forum and ended at the private source code of a tech giant was the kind of operation associated with intelligence services or state-sponsored cybercrime groups, complete with entire teams, sizable budgets, and months of preparation. Here, three independent researchers achieved a comparable result in a matter of days, using the same tools available to any developer who can afford a monthly subscription.

That doesn't mean everyone has suddenly become an elite hacker — the researchers still had the technical expertise needed to spot and exploit the initial flaw. But the most expensive part of such an attack — turning a theoretical vulnerability into a working exploit — has become accessible for a price of a few tens of dollars a month. That's good news for researchers working in security's interest, through bounty programs like OpenAI's. But it's equally bad news for everyone else: if three people with ordinary subscriptions can reach the source code of a company on OpenAI's level, how vulnerable are the rest of us? Incidents like this will certainly happen again — though not every time will the intentions behind them be quite so noble. This time, we got lucky — and a bug bounty.

 

Sources:

  1. Wall Street Journal — original source of the report (subscription required)
  2. OpenAI hacked by small team of white hat security researchers using Anthropic's Claude Opus 5 — VentureBeat
  3. AI de frontieră: toți cer pauză, nimeni nu frânează primul — AIdapted
  4. Evaluare 2026: Pentru o notă bună, au furat rezolvările și baremul chiar în timpul examenului — AIdapted
  5. Agenți AI de la OpenAI și Anthropic au creat identități false și au încercat să convingă un dezvoltator să accepte cod malițios — AIdapted
  6. "Război teritorial" între agenți AI: ce s-a întâmplat când Anthropic a pus trei modele Claude să lucreze pe același proiect — AIdapted