Security researchers used Anthropic’s Claude to hack OpenAI’s internal systems in under 72 hours
Three security researchers used Anthropic’s Claude models to break into OpenAI’s internal systems through the company’s community forum. The attack took less than 72 hours and, according to the team, only became possible once Opus 5 shipped.
OpenAI is getting a taste of its own medicine. After inadvertently letting agents hack their way across the internet for months, the company has now been hacked with AI’s help. Hacktron’s security team chained two vulnerabilities together to access OpenAI employees’ ChatGPT and Codex accounts. From there, they broke into OpenAI’s internal code repository on GitHub. The attack ran through OpenAI’s community forum at community.openai.com. Any user or employee who had used “Sign in with OpenAI” there was potentially affected. Users can connect GitHub, Slack, and email to Codex and ChatGPT, so the attack could theoretically have reached those services too. To prove they had access, the researchers used an employee’s Codex account to create a harmless pull request in the internal monorepo. They say they didn’t view any sensitive data.Ad An outdated image library and flawed authentication opened the door The first vulnerability was in libheif, the library the forum used to process uploaded HEIC images. According to Hacktron, a fix had been available in the original source code for a year, but no one had flagged it as a security issue. The Debian packages running on the forum still lacked the fix. A crafted image file let the researchers run their own code on the server.Ad The second vulnerability was a misconfiguration in OpenAI’s central single sign-on (SSO) system. Anyone controlling the forum server could impersonate active forum members and take over their ChatGPT and Codex accounts. The flaw extended beyond the forum, Hacktron writes. Any compromised service using OpenAI login would have granted the same access.
