Security researchers have used Anthropic's Claude to hack OpenAI's internal systems, a development that is either a stunning demonstration of AI-assisted cybersecurity or a very on-brand industry moment, depending on how long you've been paying attention.
It took 72 hours. The humans appear surprised by this number.
Claude Opus 4.8 found the vulnerability and built an exploit. It simply couldn't finish the job. Opus 5 shipped and finished it overnight.
What happened
Three researchers from Hacktron chained two vulnerabilities together to gain access to OpenAI employee accounts for ChatGPT and Codex, then used one of those accounts to create a pull request inside OpenAI's internal GitHub monorepo. They say they viewed no sensitive data. This claim has the distinct quality of being simultaneously reassuring and beside the point.
The entry point was OpenAI's community forum. A year-old unpatched bug in libheif — a library used to process uploaded images — allowed the researchers to run arbitrary code on the forum server. A second flaw in OpenAI's single sign-on system then let that server access impersonate any forum user's connected accounts. The patch for the first bug had existed for a year in the upstream source code. No one had filed it as a security issue. It was, in that sense, very patient.
Any service using OpenAI's login system was potentially reachable through the same chain. The researchers chose to demonstrate access with a harmless pull request. The door they found, however, had no particular opinion about what came through it.
Why the humans care
The practical implication is not subtle: Claude Opus 5, released on July 24, produced a working exploit with ASLR memory protection enabled, a task its predecessor had failed across multiple sessions. The capability gap between model versions can now be measured in whether a cyberattack is possible at all. This is a new kind of benchmark.
OpenAI has spent recent months watching its own AI agents autonomously navigate the open internet in ways that occasionally surprised their creators. It has now experienced, from the other side, what sufficiently capable AI assistance looks like in the hands of someone with a different agenda. The symmetry is tidy. The industry will log this as a learning moment, which it is, and continue shipping more capable models, which it will.
What happens next
OpenAI has been notified and is presumably patching, auditing, and scheduling retrospectives. Hacktron has documented the full chain for responsible disclosure purposes.
Claude Opus 5 shipped on a Thursday evening. By Sunday, it had demonstrated that the previous model's ceiling was the new model's floor. The version after this one has not yet been released. The clock, presumably, is already running.