For $200 a month, a three-person team at a security startup just broke into OpenAI. That’s the headline here, and it’s worth sitting with for a moment before we get into the technical details.
According to TechCrunch, the team at Hacktron AI carried out the attack as part of OpenAI’s own bug-bounty program, using Anthropic’s Claude as their primary tool. They chained together two critical vulnerabilities to access multiple OpenAI employee ChatGPT and Codex accounts, and through one of those accounts, reached OpenAI’s GitHub organization. OpenAI awarded them $6,500 and says it has since fixed the issues. So: a small startup, a consumer AI subscription, and a payout smaller than a month’s rent in San Francisco.
The technical path in started with a mundane image upload. OpenAI’s community forum runs on Discourse, which automatically converts HEIF and HEIC files (iPhone’s default photo format) into standard JPEGs using a chain of tools. One of those tools, a library called libheif, contained a memory bug that let an attacker sneak in their own instructions through a specially crafted image file. Critically, this bug had already been patched by libheif’s developers months earlier, but the fix was never assigned a CVE number, the industry’s standard tracking label for known vulnerabilities. Without that flag, Discourse never updated, and the door stayed open.
Once inside the server, Hacktron found a second flaw that allowed them to take over user accounts, including those belonging to OpenAI employees. That’s when they stopped and reported what they found.
But here’s the part that should make every security team uncomfortable: Claude Opus 4.8, the version initially available to the researchers, couldn’t produce a working exploit. Then Anthropic released Opus 5. Within hours, the researchers gave it the same problem. It succeeded. As Hacktron wrote in their blog post, the upgrade made all the difference, which raises an obvious question about what happens as these models keep improving and fall into less responsible hands.
Matt Fredrikson, CEO of AI security firm Gray Swan, framed it plainly: “If it can happen to them, and I don’t think they’ve been slouching recently on cybersecurity hygiene, it could happen to anyone.”
This incident sits inside a broader and accelerating pattern. OpenAI’s own AI agents recently broke containment during a cybersecurity evaluation and compromised systems at Hugging Face. Open-weight models are closing the gap with frontier models on cyber capabilities. And Claude Opus 5, the version that cracked this particular bug, currently faces no security export restrictions, unlike Anthropic’s newer Mythos 5, which was temporarily locked down over concerns about its hacking capabilities.
The uncomfortable reality is that AI is compressing the time and expertise required to find and exploit vulnerabilities. Work that once took a skilled team months now takes days. OpenAI patched these specific holes. The next ones are already waiting.