The Hacktron AI team received $6,500 for breaking into OpenAI systems using their competitor's model — Claude. Formally, this looks like a typical bug bounty story: they found something, reported it, got paid, and the company patched the holes. But the details reveal something more interesting — the line between "security researcher" and "a person who just knew how to ask AI the right way" has become almost invisible.
The chain from image to internal code
The attack didn't target OpenAI directly, but rather a third-party Discourse service that the company uses for its forum. Researchers prepared a specially crafted HEIF/HEIC format image that exploited a vulnerability in the libheif library, giving them control over the server. Then came a second vulnerability related to the corporate GitHub — and the team gained access to several OpenAI employee accounts in ChatGPT and to the company's internal code.
Notably, none of these holes were in the ChatGPT system itself or in OpenAI's models. The weak point turned out to be typical infrastructure periphery — a forum on someone else's platform — something almost every large company has and rarely thinks of as an entry point to attack the industry's most heavily guarded secrets.
A difference of hours between failure and success
The most telling moment in this story isn't the hack itself, but what happened before it. Claude Opus 4.8 couldn't create a working exploit for the libheif vulnerability. But as soon as Anthropic released Opus 5, the same task was solved in just a few hours.
Researchers note that AI development is reducing the time and specialized knowledge needed to find cybervulnerabilities.
This phrasing should be read literally: the difference between generations of one model over several months turned an insurmountable task into a routine one. Previously, a similar attack chain — from fuzzing image formats to privilege escalation in a corporate network — would have required a team of experienced pentesters and weeks of work. Now it can be obtained in a timeframe comparable to a work shift.
Irony against the backdrop of public warnings
The situation unfolds against the backdrop of Anthropic, Claude's creator, publicly calling for a slowdown in AI development just months ago due to loss-of-control risks. The company's CEO Dario Amodei spoke about the need to "reduce the risk of something going very wrong," and OpenAI's chief Sam Altman supported him. U.S. President Donald Trump responded by rejecting calls for stricter regulation.
Meanwhile, a tool from a company calling for caution is demonstrating in real time how much easier it has become to bypass the defenses of a technology giant's infrastructure. This isn't a contradiction in the bad sense — Hacktron AI acted legally, within the official bug bounty program, and passed all their findings to OpenAI. But the fact that such a result is now achievable by an enthusiast team for a few thousand dollars in bounty raises a practical question: if legal researchers could accomplish this in a few hours after a new model's release, how much time would it take for those who don't report their findings?
