Hackers breach OpenAI using Claude tools, gaining access to employee accounts and the company

What it is

A bug-bounty finding by Hacktron AI (the page also spells it "Hackron") against OpenAI's Discourse-powered community forum, disclosed in an X post on September 18 for a breach performed July 25. The existing summary covers the full exploit chain, the Claude Opus 5 involvement, the 14-hour patch, and the $6,500 bounty. Two things it does not carry are worth noting.

The model-version threshold

The page states the researchers first attempted to generate the libheif heap-overflow exploit with Claude Opus 4.8, and that failed — only Opus 5 succeeded at analyzing the memory structure and calculating how to trigger the overflow. For a reader gauging AI-assisted exploitation, this is the concrete signal: the capability appeared at a specific model generation, not across the family. The human researchers still uploaded the weaponized HEIF and manually executed every step after the initial RCE; the model produced the exploit code, not the operation.

Scope of access, per the researchers

The page adds that after achieving the account takeover the researchers say they immediately halted testing and did not study or download OpenAI's source code — the internal pull request was the only artifact, filed as proof. It also notes Discourse fixed its side of the issue independently, so the fix was two-party, not OpenAI-only. Full timeline from initial finding to resolution was 72 hours.

Caveats

Everything here rests on the researchers' own X-post account as relayed by the reporter; there is no independent confirmation of the "no source downloaded" claim or of which exact libheif version was outdated (no CVE or version number is given). The "authorized, cybersecurity-configured" Claude variant that "relaxes certain cyber restrictions" is described but not otherwise specified.