研究人员借助 Anthropic 的 Claude 入侵 OpenAI

在一个反映 AI 安全领域奇异新现实的转折中，据《华尔街日报》周四晚间报道，独立安全研究人员利用 Anthropic 的 Claude 入侵了 OpenAI，暴露出这家 ChatGPT 开发商防御体系中的漏洞。

初创公司 Hacktron AI 的一支三人安全团队在 OpenAI 的漏洞赏金计划中实施了这次攻击。Hacktron 将发现报告给 OpenAI，后者向该初创公司发放了 6,500 美元奖励。该团队成功串联了两个严重漏洞，获得了多个 OpenAI 员工 ChatGPT 账户的访问权限，进而进入公司的软件环境。

OpenAI 表示，已解决 Hacktron 发现的问题。这一事件发生之际，顶尖 AI 公司正面临日益增加的安全压力。

几周前，OpenAI 自己的 AI Agent 曾在一次网络安全评估中突破隔离，并入侵了 Hugging Face，展示出 AI 模型在自行决策方面正变得多么强大。这一事件也凸显，即用型技术可以被用于在即便是最先进公司的基础设施中寻找漏洞。

AI 安全公司 Gray Swan CEO Matt Fredrikson 对 TechCrunch 表示：“每月花 200 美元，任何人都能使用这些工具并入侵像 OpenAI 这样的公司。如果这能发生在他们身上——而且我不认为他们最近在网络安全卫生方面有所懈怠——那就可能发生在任何人身上。”

正如一名 AI 评论人士在社交媒体上指出的那样：“[Hacktron] 利用 Opus 5 完成了这次入侵……接下来人们会问：如果这三个人能做到，那么一个国家级行为体又能做到什么？”

研究人员于 7 月 25 日通过 OpenAI 社区论坛所使用的第三方软件 Discourse 中的一个缺陷，找到了进入 OpenAI 的路径。

根据研究人员发布的一篇博客文章，入口是一次看似普通的图片上传。当用户向 OpenAI 社区论坛发布 HEIF 或 HEIC 图片文件——这是 iPhone 默认使用的格式——Discourse 会将文件交给一系列后台工具，转换为标准 JPEG 格式。第一站是 ImageMagick，这是一款已有数十年历史、用于调整图片大小的开源工具。由于 ImageMagick 的常规工具集无法处理苹果的格式，它会将文件转交给另一个名为 libheif 的库进行解码。

libheif 内部隐藏着一个内存漏洞，为攻击者注入自身指令提供了途径。在本案中，向该库输入经过特殊构造的图片，会导致它错误计算一张图片叠加在另一张图片之上的位置，而这已足以劫持服务器。

令网络安全社区可能感到不安的是，该漏洞其实在数月前就已被 libheif 开发者修复。但该修复从未被正式标记为漏洞，因此也没有获得 CVE（常见漏洞与暴露）编号——这是业界追踪已知安全弱点的标准方式。Hacktron 表示，这或许解释了为什么 Discourse 使用的软件仍在运行存在漏洞的版本。

值得注意的是，研究人员称，他们使用的 Claude 模型——专门面向网络安全研究人员提供的 Opus 4.8 特别版本——起初无法构建可用的漏洞利用程序。情况在 Anthropic 发布 Opus 5 后一夜之间发生了变化。

Hacktron 在一篇博客文章中写道：“Opus 4.8 在多次会话中都难以生成可用的漏洞利用程序。在 Opus 5 发布后的数小时内，我们将同一个问题交给它，它成功了。”

进入 Discourse 服务器后，研究人员发现了另一个漏洞，可让他们接管用户的 ChatGPT 和 Codex 账户，其中包括属于 OpenAI 员工的账户。

Hacktron 在事件摘要中写道：“随后，我们接管了一名 OpenAI 员工的账户，该员工的 Codex 已连接至 OpenAI 的 GitHub 组织。”

在此阶段，研究人员向 OpenAI 和 Discourse 发出警报，后者于 7 月 27 日发布了修复程序。

该事件将焦点投向了模型能力边界应如何划定。最终破解该漏洞的 Claude Opus 5 尚未面临任何安全出口限制；相比之下，更新版本 Mythos 5 曾因其先进的黑客攻击能力引发担忧而被暂时锁定。

这还只是闭源模型的情况。开放权重模型正在日益追赶前沿模型的网络攻击能力。例如，AI 安全非营利组织 SaferAI 最近发现，中国公司 Z.ai 的 GLM-5.2 仅比 OpenAI 的 GPT-5.5 和 Anthropic 的 Claude Opus 4.7 落后数个月。

正如 Hacktron 创始人 Mohan Pedhapati 在 X 上所说：“AI 正在减少开发漏洞利用程序所需的稀缺专业知识。过去需要数月的工作，现在可能只需数天。”

In a twist that captures the strange new state of AI security, independent security researchers have used Anthropic’s Claude to break into OpenAI, exposing cracks in the ChatGPT-maker’s defenses, The Wall Street Journal reported on Thursday evening.

A three-person security team at startup Hacktron AI carried out the attack as part of an OpenAI bug-bounty program. Hacktron reported its findings to OpenAI, which gave the startup a $6,500 award. The team managed to chain together two critical vulnerabilities to gain access to multiple OpenAI employee ChatGPT accounts, which gave them entry into the company’s software.

OpenAI says it has resolved the issues Hacktron uncovered, which happens to come at a moment when top AI companies are under growing pressure over safety.

This incident comes several weeks after OpenAI’s own AI agents broke containment during a cybersecurity evaluation and hacked Hugging Face, demonstrating just how capable AI models are getting at making their own decisions. It also highlights how off-the-shelf technology can be used to find vulnerabilities in even the most advanced companies’ infrastructure.

“For $200 a month, anyone can use these tools and hack into a company like OpenAI,” Matt Fredrikson, CEO of AI security firm Gray Swan, told TechCrunch. “If it can happen to them — and I don’t think they’ve been slouching recently on cybersecurity hygiene — it could happen to anyone.”

Or as one AI pundit noted on social media: “[Hacktron] used Opus 5 to pull off the hack…The question that will be asked is, if these three guys can pull this off, what can a nation state do.”

The researchers found a path into OpenAI on July 25 via a flaw in Discourse, the third-party software powering OpenAI’s community forum.

According to a blog the researchers published, the entry point was a mundane image upload. When users posted HEIF or HEIC image files (the format iPhones use by default) to OpenAI’s community forum, Discourse passed them through a chain of behind-the-scenes tools to convert them into standard JPEGs. Its first stop was ImageMagick, a decades-old, open source utility used to resize images. Because ImageMagick’s usual toolkit can’t deal with Apple’s format, it handed the file off to another library called libheif to do the decoding.

Buried inside libheif was a memory bug that exposed a path for an attacker to sneak in their own instructions. In this case, feeding the library a specially crafted image caused it to miscalculate where one image was positioned on top of another, which proved enough to hijack the server.

What may be uncomfortable for the cybersecurity community is that bug had already been fixed months earlier by libheif’s developers. But the fix was never formally flagged as a vulnerability, meaning it never got a CVE (common vulnerabilities and exposures) number, the industry’s standard way to track known security weaknesses. Hacktron says that may explain why the software used by Discourse was still running the vulnerable version.

Notably, the researchers said the Claude model they were using — a special version of Opus 4.8 made available for cybersecurity researchers — couldn’t build a working exploit at first. That changed overnight, when Anthropic released Opus 5.

“Opus 4.8 struggled across several sessions to produce a working exploit,” Hacktron wrote in a blog post. “Within hours of Opus 5’s release, we gave it the same problem and it succeeded.”

Once inside the Discourse server, the researchers found another flaw that let them take over users’ ChatGPT and Codex accounts, including those belonging to OpenAI employees.

“We then took over an OpenAI employee’s account, whose Codex was connected to OpenAI’s GitHub organization,” Hacktron wrote in its summary of the event.

At this point, the researchers alerted OpenAI as well as Discourse, which issued a fix on July 27.

The incident puts a spotlight on where the line gets drawn for model capabilities. Claude Opus 5, the version that ultimately cracked the bug, hasn’t faced any security export restrictions, unlike newer version Mythos 5, which was temporarily locked down over concerns about its advanced hacking capabilities.

Those are just the closed models. Open-weight models are increasingly catching up to the frontier in cyber capabilities. For example, AI safety nonprofit SaferAI recently found that Chinese company Z.ai’s GLM-5.2 was only a few months behind OpenAI’s GPT-5.5 and Anthropic’s Claude Opus 4.7.

As Hacktron founder Mohan Pedhapati put it on X: “AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days.”