Where Sources Agree

• arrows_inputBreach Execution Path: Coverage broadly details how Hacktron researchers used Anthropic’s Claude to chain a forum image-processing vulnerability with an SSO flaw, enabling unauthorized access to OpenAI internal systems within 72 hours, per Hacktron’s technical disclosure.
• arrows_inputAI-Accelerated Exploit Development: Outlets generally confirm that Claude Opus 4.8 failed to generate a reliable exploit, with the newer Opus 5 model producing a working version within hours, according to Hacktron researchers.
• arrows_inputOpenAI Response and Bounty: Coverage largely emphasizes that OpenAI addressed the breach by fixing the single sign-on issue within 14 hours, revoking affected tokens, and issuing a $6,500 bounty to the researchers, according to official OpenAI statements.

Where Sources Disagree

• arrows_outputClaude Model Access: Some reports state researchers used the standard Claude Opus 5 model to develop their exploit. In contrast, other outlets specify that the team utilized a special, restricted version of Claude provided by Anthropic specifically for authorized cybersecurity researchers.
• arrows_outputBounty Program Attribution: Reports vary slightly in their description of the bounty process; while some outlets specify that OpenAI paid the reward through its Bugcrowd program, others describe the payment generally as part of OpenAI's bounty program without naming the specific platform.
• arrows_outputModel Restriction Context: Reports vary slightly in their technical detail, with some outlets noting that the more advanced 'Mythos 5' model, which is restricted to vetted organizations, was not involved in the breach.