Cybersecurity Startup Uses Claude AI to Hack OpenAI, Earn $6,500 Bug Bounty

A three-person research team found and chained two vulnerabilities in OpenAI infrastructure: a libheif-related remote code execution in the public community forum and an SSO token weakness that allowed account takeover and access to OpenAI’s internal GitHub. The team used AI assistance (Anthropic Claude) during exploit development, demonstrated access by creating an internal pull request, reported the issues to OpenAI, and the company remediated the flaws and paid a $6,500 bounty.