Anthropic Uses Claude to Build Next AI Model
Left 50%
Center 50%
Right 0%
1 left · 1 center · 0 right
What happened
In late July, a three-person team at Hacktron, a small San Francisco cybersecurity startup, used Anthropic’s Claude models to exploit a flaw in Discourse, the third-party software that hosts OpenAI’s community forum. A crafted HEIF image triggered a memory bug in the libheif library during image conversion, yielding remote code execution on Discourse’s servers; the researchers then chained a second issue to take over OpenAI employees’ ChatGPT and Codex accounts, including one linked to OpenAI’s internal GitHub organization. Hacktron said it did not read internal source code, reported the issues to OpenAI and Discourse, and received a $6,500 bug-bounty payment. OpenAI confirmed the report, narrowed permissions on community sign-in tokens, and revoked affected tokens and sessions; Discourse issued a fix on July 27.
Sourcing check · Mostly on the record · 5 articles
4 of 5 articles cite a named source for the story. It was on the record from the first report, credited to The Wall Street Journal. Most articles credit The Wall Street Journal rather than reporting it themselves.
What these terms mean and how they're counted
- On the record · names a source 4 of 5
- On the record means the article cites a source by name for the story's main claim: a person, or an institution speaking officially, such as a company statement or a named agency's spokesperson. The opposite is an unnamed source. The count is how many of the counted articles cite at least one such source; the names are everyone named across them, each once however the articles spell it. Here: Hacktron AI, OpenAI, The Wall Street Journal, Matt Fredrikson, Hacktron and Anthropic
- Primary evidence · cites a document or data 2 of 5
- Primary evidence means the article cites a record you could check yourself: a court filing or ruling, a dataset or report, a recording or transcript, an official statement or press release, market data. A quote is not a document. The count is how many articles cite one. Here: researchers' blog, blog post, news report
- Credits another outlet 3 of 5
- The article says the story comes from another outlet's reporting (“first reported by Reuters”). Those articles relay the story; they are not independent confirmation. Here: The Wall Street Journal, Wall Street Journal
- Unnamed sources 1 of 5
- The main claim is attributed to people who are not identified: “people familiar with the matter”, “officials said”. The count is how many articles do this.
- How it developed
- When the first report landed and whether it named anyone; when the first named source and the first document appeared. Here: First report Sep 18, 14:00 UTC by TechCrunch, crediting The Wall Street Journal, naming its source. First document in the first report, from TechCrunch (researchers' blog).
- Not counted 0
- Opinion, analysis and video pieces, and articles too short to assess. Every count above is out of the counted articles. An article republished under a new headline is one article.
This is about who is cited, not whether the story is true. Each source below says what it names. How we count
ONE-SIDED THIS WEEK.
Only left-leaning outlets have covered this story in the last two days;
Washington Examiner reported it on 2026-09-12.
Omitted — what each side leaves out
Unpacked
Right-leaning coverage has not reported this incident at all, so those readers miss that researchers used Claude to seize OpenAI employee ChatGPT accounts through a community-forum flaw. Left-leaning coverage reports the forum-to-account chain and OpenAI's patch, but it disagrees on how far inside the company the team got. Business Insider says they accessed no internal code, while The Verge says they reached a GitHub repository holding "algorithmic secrets."
Left-leaning outlets also split on the lead. NBC News opens as if hackers "breached OpenAI," while Business Insider opens on a tiny startup that reported a hole and got paid. Both describe the same disclosed, patched bounty case, and both carry OpenAI's thanks to the researchers.
What, if anything, inside OpenAI's internal repository did the researchers actually view before they stopped?
Bottom line
Left-leaning coverage prices the Claude chain into OpenAI employee accounts at a $6,500 bounty; right-leaning coverage has not reported the hack at all.
The receipts — 6 facts one side's coverage lacks
- The team reached OpenAI's GitHub repository called Monorepo, which reportedly contains OpenAI's algorithmic secrets.
- Hacktron stopped without accessing any internal OpenAI code after taking over an employee Codex account.
- OpenAI paid Hacktron $6,500 for the discovery.
- OpenAI said it narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions.
- A memory bug in libheif had already been fixed months earlier but never received a CVE, so Discourse still ran the vulnerable version.
- Claude Opus 4.8 could not produce a working exploit; Opus 5 succeeded on the same problem within hours of release.
The Left View
Left-leaning outlets covering the story treat it as a concrete example of AI security risk, not a rumor. Business Insider, The Verge, and NBC News report that Hacktron used Claude (Opus 4.8, then Opus 5) under Anthropic’s cybersecurity-research access to breach OpenAI in under 72 hours, win a $6,500 bounty, and stop short of copying internal code. They describe the technical path (Discourse, HEIF/libheif, employee ChatGPT/Codex, GitHub “Monorepo”) and OpenAI’s on-the-record confirmation and patch. Framing is alarm-oriented: the incident is tied to OpenAI agents previously hacking Hugging Face, fears of malicious AI agents, and nation-state capability. NBC quotes a researcher saying the chain resembled APT tradecraft and notes U.S. accusations of Chinese economic espionage; The Verge highlights Hacktron’s remark that three people with Claude subscriptions are weaker than Chinese threat actors, and that a similar “HEIF Heist” was adapted to other firms for under $3,000 in tokens.
Our Take (balanced)
The story is substantive, not thin: named company and researchers, a published disclosure, a specific dollar bounty, a checkable technical chain, and an on-the-record OpenAI statement that findings were received and tokens/sessions were revoked. Established: authorized bug-bounty research found chained Discourse and OpenAI account-token issues in late July; OpenAI and Discourse patched; Hacktron was paid $6,500. Attributed to Hacktron (and to WSJ sourcing in some writeups), not independently proven in these articles: that Claude Opus 5 was decisive, that employee Codex could have reached “algorithmic secrets” in Monorepo, and that the same path would have been trivial for a nation-state. Anthropic did not comment. No right-leaning outlet has reported this. Watch for Hacktron’s full technical write-up, a Discourse/libheif advisory or CVE, a more detailed OpenAI incident note, and any Anthropic statement on the Cyber Verification Program and Opus 5.
6 sources
- This tiny cybersecurity startup managed to hack OpenAI using Claude, and won a $6,500 bounty
- Security researchers used Claude to help them hack into OpenAI
- Hackers breached OpenAI, adding to fever pitch of security and safety concerns
- Researchers used Anthropic’s Claude to hack into OpenAI
- AI security experts say they used Claude to hack ChatGPT
- Researchers report using Anthropic's Claude to hack OpenAI's ChatGPT
More stories
The week's bottom lines, in your inbox
One email a week: the five stories that mattered and what they actually mean. Free.