Independent security researchers used Anthropic's Claude to invade OpenAI systems, revealing gaps in the company's defenses behind ChatGPT. He broadcast the news Wall Street Journal.
The attack was carried out by a three-member security team of the Hacktron AI startup, as part of the OpenAI Bug Bounty program. Combining two critical vulnerabilitys, researchers gained access to multiple ChatGPT accounts of OpenAI employees and, through them, to the company's own software. For the findings reported, OpenAI awarded them a $6,500 reward.
OpenAI has now corrected the issues identified by the team, at a time when top AI companies are under increasing pressure for their safety.
The incident comes a few weeks after OpenAI agents escaped control during a cybersecurity assessment and They violated Hugging Face., showing how capable they are of making autonomous decisions. It also shows how easy tools available freely on the market can turn to identifying vulnerability even to the infrastructure of the most advanced companies.
«At $200 a month, anyone can use these tools and invade a company like OpenAI», stated in TechCrunch Matt Fredrikson, CEO of cybersecurity company AI Gray Swan. «If it can happen to them, and I don't think they have recently neglected their basic cybersecurity, it can happen to anyone.»
An AI analyst commented on social media: «[The Hacktron] used Opus 5 to execute the attack... The question that will be asked is: if these three have succeeded, what can a state do?»
Entrance to OpenAI systems was detected on July 25, through a gap in Discourse, the third manufacturer software that feeds the OpenAI community forum. The entry point was a simple image download.
When one uploaded HEIF or HEIC files (the format used by default iPhones) on the forum, Discourse passed them through a series of tools running in the background to convert them to standard JPEG. First station was ImageMagick, a decades open code tool used to resize images. Because it cannot process Apple's format, it transferred the file to another library, libheif, for decoding.
Inside libheif was hiding a memory error that opened a path to an attacker introducing his own orders. Feeding the library with a specially constructed image, they forced it to miscalculate the location of one image on the other, which proved to be enough to gain control of the server.
The concern for the cybersecurity community is that the error had already been corrected months earlier by libheif developers. However, the correction was not officially registered as vulnerability, so it never received a CVE number (Common Vulnerability and Exposures), the standard used by the industry to record known security weaknesses. This may explain why the software behind Discourse was still running the vulnerable version.
The Claude model used by researchers, a special version of Opus 4.8 available for cybersecurity researchers, was initially unable to create a functional exploit. This changed from day to day, with the release of Opus 5.
«Opus 4.8 had difficulty in multiple sessions producing a functional exploit», wrote Hacktron AI on her blog. «Within hours of Opus 5 release, we gave him the same problem and he succeeded.»
Once found inside the Discourse server, researchers discovered another gap, allowing them to take control of ChatGPT and Codex accounts, including OpenAI employee accounts. «We then took control of the account of an OpenAI employee whose Codex was affiliated with the OpenAI organisation in GitHu b», the group wrote in the summary of the case.
At that point, researchers notified both OpenAI and Discourse, which issued a correction on 27 July.
Η υπόθεση φέρνει στο επίκεντρο το ερώτημα του πού τίθενται τα όρια στις δυνατότητες των μοντέλων. Το Claude Opus 5, η έκδοση που τελικά εκμεταλλεύτηκε το σφάλμα, δεν έχει αντιμετωπίσει περιορισμούς εξαγωγής για λόγους ασφαλείας, σε αντίθεση με το νεότερο Mythos 5, που τέθηκε υπό προσωρινούς περιορισμούς λόγω ανησυχιών για τις προηγμένες ικανότητές του στο hacking.
Οι περιορισμοί αυτοί αφορούν μόνο τα κλειστά μοντέλα. Τα μοντέλα ανοιχτών βαρών πλησιάζουν ολοένα και περισσότερο τα κορυφαία μοντέλα στην κυβερνοασφάλεια: η μη κερδοσκοπική SaferAI διαπίστωσε πρόσφατα ότι το GLM-5.2 της κινεζικής Z.ai υστερεί μόλις λίγους μήνες σε σχέση με το GPT-5.5 της OpenAI και το Claude Opus 4.7 της Anthropic.
«Η AI μειώνει την εξειδικευμένη γνώση που χρειάζεται για να αναπτύξει κανείς exploits. Δουλειά που κάποτε απαιτούσε μήνες μπορεί πλέον να γίνει σε μέρες», δήλωσε ο ιδρυτής της Hacktron, Mohan Pedhapati, σε ανάρτησή του στο X.
