Security Researchers Used Claude Opus 5 to Breach OpenAI in Under 72 Hours

The most striking AI security story of the year is also the simplest to state: a three-person white-hat team called Hacktron AI used Anthropic’s newly released Claude Opus 5 to breach OpenAI’s own systems, completing the exploit chain in under 72 hours for roughly $3,000 in tokens, per VentureBeat and coverage across CybersecurityNews and Hacker News. The target was the OpenAI Forum and employee accounts, and the team worked under the bug bounty program, receiving an award of about $6,500.

The Attack Chain: One Overflow, One Misconfiguration, One Model

The technical path is a lesson in modern exploitation. The Hacktron team first placed Claude in an autonomous goal loop against a Discourse Cloud test instance to develop and validate the exploit, then chained two real flaws: a libheif heap overflow (an image-decoder vulnerability) and an SSO misconfiguration, combining them into account takeover of OpenAI Forum accounts. Per the WSJ’s report, stolen employee tokens then granted access to connected services, and the team proved access with a harmless pull request to OpenAI’s codebase. The model’s contribution was compressing the exploit development cycle: vulnerability research, weaponization, and validation that previously took a skilled team weeks happened autonomously in days.

The Irony Stack Is Now Three Layers Deep

The context makes this story land harder than the raw facts. Anthropic’s model was used to breach OpenAI weeks after Anthropic published its own threat-intelligence report naming distillation and misuse campaigns, weeks after OpenAI disclosed six misalignment incidents in its own models, and days after Amodei’s pacing essay warned a capable swarm could take over the internet within 6-12 months. The breach was authorized and the bounty was paid, which is exactly the point: this is what the defensive tier of AI exploitation looks like, and the offensive tier differs only in permission.

What to Watch

Three questions follow. First, will Anthropic and OpenAI publish joint postmortems, since both labs’ systems appear in the disclosure? Second, does this accelerate the embedded-evaluator commitments from voluntary to contracted, given that a $3,000 token budget defeated an SSO boundary? Third, do bug-bounty platforms formalize AI-assisted submission categories, because Hacktron’s economics (a $6,500 payout against $3,000 in tokens) just made autonomous exploitation a business line. The debate about whether this was authorized testing or a breach is itself the story: the line has never been clearer, and the capability is now commodity.