Researcher Awarded $6,500 for Breaching OpenAI Using Claude
TEMPO.CO, Jakarta - A team of independent cybersecurity researchers has successfully discovered a security loophole in the OpenAI system. The researchers, often referred to as ethical hackers, used Claude, an artificial intelligence (AI) from Anthropic, to locate and penetrate the system instead of manually writing hacking code.
Three individuals from a startup company called Hacktron AI designed the attack. Their success story was later covered by major global media outlets.
Hacktron reported their findings to OpenAI, resulting in a US$6,500 award. The team successfully exploited two critical vulnerabilities to access several ChatGPT accounts belonging to OpenAI employees. They eventually found a way into the company's software.
OpenAI has announced that they have resolved the issues identified by Hacktron. The researchers found an entry point into OpenAI on July 25 through a vulnerability in Discourse, a third-party software used to run the OpenAI community forum.
According to a TechCrunch article quoted in a researchers’ blog post, a loophole arose from a simple activity on September 18, 2026: uploading images. If you upload HEIF or HEIC format images from an iPhone to OpenAI's community forum, Discourse will process them into standard JPEG format. This process involves ImageMagick and a library called libheif.
In fact, Libheif has a memory bug that allows attackers to embed their own instructions. By providing specially crafted images, the researchers made the library miscalculate the position of one image placed on top of another. This mistake was sufficient to take over the server.
Hacktron management claims that the libheif developers had actually fixed the bug several months prior. However, the fix was not officially marked as a vulnerability, so it did not receive a Common Vulnerabilities and Exposures (CVE) number, an industry standard system for tracking security flaws. This condition is likely why Discourse was using an outdated version of the software.
The Claude Opus 4.8 model from Anthropic, which the researchers used, could not initially assist with exploit functions or hacking code. This condition changed after Anthropic released Opus 5. "Within hours of Opus 5’s release, we gave it the same problem and it succeeded," Hacktron's announcement stated.
After gaining access to the Discourse server, the researchers discovered a vulnerability that could be exploited to take over ChatGPT and Codex user accounts, including those belonging to OpenAI employees. The researchers then reported their findings to OpenAI and Discourse, which subsequently issued fixes on July 27, 2026.
The incident occurred a few weeks after OpenAI's AI agent successfully escaped from testing environments during a cybersecurity evaluation and breached Hugging Face. Matt Fredrikson, the head of AI security company Gray Swan, said the capabilities of the AI tool could enable similar attacks at other companies.
These developments also demonstrate the growing capabilities of AI models in cybersecurity. According to Hacktron's founder, Mohan Pedhapati, AI reduces the need for specialized expertise in exploit development. "Work that once took months can now take days," Pedhapati tweeted on X.
