Claude Opus 5 Used to Breach OpenAI — How Researchers Bypassed Authentication in 72 Hours── As AI accelerates vulnerability discovery, defenders must use AI to probe their own systems first

On September 18, 2026, security firm Hacktron AI reportedly used Anthropic's Claude Opus 5 to reach OpenAI employee accounts and internal GitHub repositories in 72 hours, chaining a forum image-processing bug through a single sign-on weakness. When AI can be used for both attack and defense, which side should pharmaceutical companies place it on? Placing AI on the defensive side requires first identifying the organization's attack surface and using AI to probe it before an adversary does.

01A single image-processing vulnerability turned into GitHub access in 72 hours

Hacktron AI, an India-based security research team, found a vulnerability in the image processing of the OpenAI community forum, which runs on Discourse. According to VentureBeat, Claude Opus 5 helped identify missing security backports and develop a working exploit that turned a memory-corruption bug into remote code execution. From there, a weakness in single sign-on (SSO) integration was chained, leading to access to an employee account. Forbes reported that the entire path from discovery to access took less than 72 hours.

Hacktron AI had reported the vulnerabilities to both OpenAI and Discourse's developers back in July. According to Business Standard, OpenAI subsequently tightened its security rules. The disclosure falls within the context of white-hat security research. The issue is not the researchers' intent but the speed at which AI can now find exploitable weaknesses.

02AI multiplies the speed of vulnerability discovery several times over

In traditional penetration testing, experienced specialists study a system's architecture, form hypotheses, and test attacks one by one. This process can take weeks or months. What Claude Opus 5 contributed was the identification of a specific missing backport and the transformation of that gap into a viable exploit. The human researcher chose the direction; the AI found the weakness within a vast space of possibilities. This combination compressed the time from discovery to access to 72 hours. In a traditional engagement, the same chain might have taken weeks to identify and months to exploit.

This is not a weapon available only to attackers. If defenders can use AI at the same speed, they can probe their own systems before an adversary arrives. The question is whether defenders are keeping pace.

03If attackers adopt AI first, defenders fall behind

Manual penetration tests are typically conducted once or twice a year. Between tests, systems change and new vulnerabilities emerge. AI-assisted testing can run continuously, re-probing after every change. The BBC's discussion of whether AI could pose a threat to humanity includes concerns about the widening gap between the speed of attack and the speed of defense. Bloomberg Law's observation that runaway AI agents are now real describes what happens when defense falls behind.

04The attack surface is every point that accepts external input

In security terminology, the attack surface is the totality of all points where a system accepts external data. Web forms, APIs, image uploads, single sign-on integrations, email attachment processing — any of these can serve as the starting point for an attack. In OpenAI's case, the forum's image-processing function was one such point. The forum is not the core product but a peripheral feature, yet it provided a path to the core accounts.

Invezz's reporting emphasized this point: "Hacktron AI first broke into the Discourse software that powers OpenAI's community forum by exploiting a flaw in how it processed uploaded images." Attack surfaces often exist not in the most important features but in the most overlooked contact points.

05Material review systems also have web inputs and authentication, so an attack surface exists

Pharmaceutical material review systems maintain external contact points out of operational necessity. Web forms and email attachments are used for material submission. Reviewer logins connect through SSO. File sharing with external reviewers uses yet another pathway. Each of these can carry the same structural weaknesses as the OpenAI forum. As CoinGape reported, the researchers gained access to an employee's ChatGPT account and had a path to read and propose changes to private OpenAI software. If a material review system were similarly compromised, unauthorized access to confidential materials under review could result.

06Vulnerability chaining works because one weakness becomes a foothold for the next

Evaluating vulnerability severity individually is common practice. The CVSS (Common Vulnerability Scoring System) is a widely used framework for this. But this case demonstrated that a vulnerability rated "medium" in isolation can become "critical" when combined with another. The image-processing bug alone would have remained a limited forum issue. Chained with the SSO weakness, it opened access to employee accounts and internal GitHub repositories.

Anthropic itself disclosed on the same day that it was investigating three incidents in its own cybersecurity evaluations. The timing was not coincidental; the same week that saw a white-hat breach of one AI company also saw a leading AI developer acknowledge its own security gaps. This shows that AI companies themselves are also exposed to vulnerability chaining. Vulnerabilities must be assessed not by their individual severity but by their potential for chaining.

07Defenders must use AI to probe their own systems before attackers do

Using AI for defense requires three practical steps.

First, inventory the attack surface. List every point that accepts external input — web forms, authentication integrations, file uploads, and exposed APIs. The most commonly overlooked items are not core products but peripheral features like forums and admin panels.

Second, run AI-assisted vulnerability scans on a regular basis. Annual or biannual manual tests cannot keep pace with the rate at which systems change. Continuous AI-driven probing closes the gap between changes and testing.

Third, establish a cycle of remediation and re-probing. Finding a vulnerability is not the end; after fixing it, probe again to confirm the fix did not introduce new weaknesses. For material review systems, the first targets for this cycle are the material submission form's file parsing, the reviewer SSO integration, and the external reviewer file-sharing pathway.