Researchers Used Claude to Hack OpenAI. What SMBs Should Do

Three independent researchers broke into OpenAI by uploading an image to its community forum, and they used Anthropic's Claude to help build the exploit. The work was done inside OpenAI's bug-bounty program, reported responsibly, and paid out at $6,500. The reason a business owner should care has nothing to do with OpenAI: the weak point was ordinary third-party software with an outdated component, which is exactly what most small companies run.

What actually happened

As reported by TechCrunch, citing The Wall Street Journal, a team at the startup Hacktron AI chained two critical vulnerabilities together and ended up inside multiple OpenAI employee ChatGPT accounts, which gave them a path into the company's software.

The entry point was mundane. OpenAI's community forum runs on Discourse, third-party software. When someone uploaded an iPhone-format image (HEIF or HEIC), Discourse converted it to JPEG through a chain of background tools: first ImageMagick, which cannot read Apple's format, then a library called libheif to do the decoding. libheif contained a memory bug. A specially crafted image made it miscalculate how one image sat on top of another, and that was enough to take over the server.

Here is the uncomfortable part. The libheif developers had already fixed that bug months earlier. But the fix was never formally registered as a vulnerability, so it never received a CVE number, the industry's standard tracking identifier. Hacktron suggests that is why the vulnerable version was still in use.

Once on the forum server, the researchers found a second flaw that let them take over users' ChatGPT and Codex accounts. One of them belonged to an OpenAI employee whose Codex was connected to the company's GitHub organization. The researchers found the way in on July 25 and alerted both OpenAI and Discourse; Discourse shipped a fix on July 27. OpenAI says the issues are resolved.

One more detail matters. The Claude version the team started with, a research build of Opus 4.8, failed across several sessions to produce a working exploit. Anthropic released Opus 5, they handed it the same problem, and it worked within hours.

Why this matters for a small business

Two things changed here, and neither is about big labs.

First, the skill barrier dropped. Hacktron's founder said publicly that AI is cutting the amount of rare expertise needed to build an exploit, turning months of work into days. An executive at the security firm Gray Swan put it more bluntly to TechCrunch: for a $200 monthly subscription, anyone can use these tools, and if it can happen to a company that takes security seriously, it can happen to anyone.

Second, the attack path was boring. Nobody guessed a password. They used a support forum, an image converter, and an outdated open-source library that nobody flagged because it had no CVE number. Your booking widget, your helpdesk, your WordPress plugin stack and your image processing pipeline are built from the same kind of parts. Many small companies rely on patching only what their monitoring tool warns them about — and this bug would never have triggered that warning.

The chain is also worth noting. A forum account led to a work account, which led to a code repository. Small companies build the same chains without thinking about them: the same email logs into the CRM, the hosting panel and the payment dashboard.

What to do this month

• Turn on two-factor authentication everywhere that touches money, code or customer data. Hosting, domain registrar, payment provider, CRM, GitHub or GitLab, email. Make it mandatory for staff, not optional.
• Do an access review. List every person with admin rights to every system. Remove former employees, contractors who finished, and accounts nobody recognizes. Do it once, write down the list, repeat quarterly.
• Apply the same rules to secondary accounts. Forums, support desks, community platforms and marketing tools are treated as low-risk and often share credentials with the systems that matter. Give them separate passwords and their own second factor.
• Update dependencies on a schedule, not on alerts. Ask whoever maintains your site to update the libraries, plugins and base images monthly, including components that have no reported vulnerability. This story exists because a fixed bug carried no CVE.
• Limit what a single compromised account can reach. If one login opens the code repository, the production server and the customer database, split those permissions now.

None of this is advanced. It is the checklist that would have broken the chain described above at three separate points. The tooling attackers use is getting better quickly, and the defenses that still work are unglamorous and cheap.