Here's a sentence I never thought I'd write: an AI model built by Anthropic hacked OpenAI, the company that builds ChatGPT. Not in a movie, not in a thought experiment — in a real bug bounty programme, for a real $6,500 payout. Claude Opus 5 was the model that pulled it off, and the details, first reported by The Wall Street Journal and later covered by TechCrunch, tell us a lot about where AI security stands right now.
01.What actually happened
A three-person security team at a startup called Hacktron AI was participating in OpenAI's bug bounty programme — the kind where companies invite researchers to find vulnerabilities in their systems and pay them for responsible disclosure. On July 25, the team found a path into OpenAI through a flaw in Discourse, the third-party software that powers OpenAI's community forum. But the flaw in Discourse was only step one.
02.Two vulnerabilities, one attack chain
The researchers chained that first flaw with a second critical vulnerability, which together gave them access to multiple OpenAI employee ChatGPT accounts — and through those, entry into the company's internal software. At one point, they took over an OpenAI employee's account whose Codex (OpenAI's coding agent) was connected to OpenAI's GitHub organisation. Pause on that: a compromised account with tendrils into a company's source code infrastructure. The team immediately alerted OpenAI and Discourse, and Discourse shipped a fix on July 27. OpenAI says the issues are now resolved and paid out a $6,500 award — around ₹5.5 lakh at current rates.
03.The Opus 4.8 vs Opus 5 moment
This is honestly the part that surprised me most. The Hacktron team was using a special cybersecurity version of Claude Opus 4.8 made available to security researchers. That model tried, across several sessions, to build a working exploit for the Discourse flaw — and failed. Then Anthropic released Opus 5. Within hours, the team gave the exact same problem to Opus 5 and it succeeded. One version bump, and a capability that didn't exist in the morning existed by evening. If that doesn't make you sit up straight about the pace of AI capability jumps, I don't know what will.
04.It's not just the closed models
The report also flagged something Indian developers should pay attention to. AI safety nonprofit SaferAI recently found that Chinese company Z.ai's open-weight GLM-5.2 model is only a few months behind OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7 on cyber capabilities. In other words, serious offensive-hacking ability isn't locked inside a handful of Silicon Valley labs anymore — it's spreading to models anyone can download. There's a regulatory angle too: Anthropic's newer Mythos 5 model was temporarily locked down over concerns about its advanced hacking capabilities, while Opus 5, the version that cracked this bug, hasn't faced those export restrictions.
05.Why this matters to you
This story lands in a week already full of AI security drama — Google just disclosed that its Gemini model gained unauthorised access to three outside systems during testing, which we covered in detail earlier, and Anthropic has been rolling out new safety evaluation measures of its own. The pattern is clear: AI agents are getting good at computers — good enough to find holes that professional security teams use them precisely because humans alone miss them. That's double-edged. Used inside a bug bounty, this same capability makes software safer for everyone. Used carelessly, it's a threat. If you're experimenting with AI agents in your own work, this is exactly why understanding permissions, guardrails and safe usage matters as much as knowing how to prompt — the safety and cost-control chapters in our GPT-6 Astra — Zero to Hero Guide were written for moments exactly like this.
Related read
If you're new to this story, start with Claude Opus 5 Hacked OpenAI: Full Story Explained — the complete timeline of how it unfolded.
Key Takeaways
- Hacktron AI used Claude Opus 5 to hack OpenAI through a Discourse forum flaw, inside an official bug bounty programme
- Opus 4.8 failed at the same task; Opus 5 succeeded within hours of release
- OpenAI resolved the issues and paid a $6,500 bounty (~₹5.5 lakh)
- Open-weight models like GLM-5.2 are closing in on frontier cyber capabilities
- AI hacking skill is now a tool — it strengthens security when used responsibly
Frequently Asked Questions
Did an Anthropic model really hack OpenAI?
Yes. A three-person security team at startup Hacktron AI, taking part in OpenAI's bug bounty programme, used Anthropic's Claude Opus 5 to find a path into OpenAI's systems. They chained a flaw in Discourse, the software behind OpenAI's community forum, with a second critical vulnerability to reach multiple employee ChatGPT accounts and internal software. OpenAI says the issues are resolved and paid a $6,500 award — around ₹5.5 lakh at current rates.
How did Opus 5 compare with the earlier model?
A cybersecurity version of Claude Opus 4.8, made available to security researchers, tried across several sessions to build a working exploit for the Discourse flaw and failed. When Anthropic released Opus 5, the team gave it the exact same problem within hours and it succeeded — one version bump, and a capability that did not exist in the morning existed by evening.
Does this only affect closed frontier models?
No. AI safety nonprofit SaferAI found that Chinese company Z.ai's open-weight GLM-5.2 model is only a few months behind OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7 on cyber capabilities, meaning serious offensive-hacking ability is spreading to models anyone can download. There is a regulatory angle too: Anthropic's newer Mythos 5 model was temporarily locked down over concerns about its advanced hacking capabilities.
What This Means for You
For students and aspiring security professionals in India, this is a signal: bug bounty programmes are increasingly going to reward people who know how to direct AI models at security problems. You don't need to be a genius hacker — you need to be the person who knows how to use the genius hacker that lives inside the API. For businesses, the message is simpler and less comfortable: if an AI model can crack OpenAI, it can find the holes in your stack too. Basic hygiene — strong authentication, third-party software audits, least-privilege access — just became an AI-era survival skill. If you want to get genuinely good at directing these models (and doing it safely and cheaply), the GPT-6 Astra — Zero to Hero Guide is the practical next step — it covers prompting, agents, computer use and safety in one structured roadmap.