Updated 1w+ ago · Tech

Google's Gemini AI Hacked Three Companies in Test

Three Hacktron AI researchers broke into OpenAI employee accounts on July 25 and reached an internal code repository, completing the operation in under 72 hours.

Two chained bugs — one in Discourse's image processing, one in OpenAI's sign-in system — enabled the breach.
$6,500 was OpenAI's bug-bounty payment to Hacktron for reporting the vulnerabilities.
Claude Opus 4.8 failed to produce a working exploit; Opus 5, released overnight, succeeded within hours.
The researchers spent under $3,000 in tokens and adapted the same attack to multiple companies.

Why it matters: The attack path ran through a mundane image upload. A memory bug in libheif, a library used to convert iPhone-format photos, let the researchers hijack Discourse's server. A second flaw then turned a forum session into a key for OpenAI employee accounts, including one linked to a private GitHub repository.

The libheif bug had already been fixed by its developers but was never assigned a CVE, so Discourse was still running the vulnerable version.
Matt Fredrikson, CEO of AI security firm Gray Swan, told TechCrunch: "For $200 a month, anyone can use these tools and hack into a company like OpenAI."

How 38 sources split on this story

Source landscape

Factuality

High

Mixed

Low

Strong LeftLeftLean LeftCenterLean RightRightStrong Right

Political Bias

Coverage by lean% of 38 sources

38 sources · 47 articles · 50% Center coverage

Where they split: Coverage disagrees on whether AI-assisted hacking represents a manageable technical problem or a fundamental shift in who can mount sophisticated cyberattacks.

Center coverage, 19 sources: The center treats the incident as one data point in a broader pattern of AI-enabled cybersecurity risk, noting that regulators are focused on long-term threats while near-term technical vulnerabilities go unaddressed.

Semafor1w+AI cybersecurity risks explode as Claude used to break into ChatGPT The National Desk1w+Google says its Gemini AI model hacked 3 other companies: reports Axios1w+Google is the latest AI lab with a security testing mishap BBC News1w+Google's Gemini AI hacked three companies in security test Bloomberg1w+Google’s Gemini AI System Hacked Three Systems in Safety Tests CNBC1w+Google's Gemini becomes latest AI model to break out and hack computer systems CTV News1w+Gemini hacked three companies in first known breakout by Google’s AI Deutsche Welle1w+Google's Gemini AI hacked 3 companies during testing Engadget1w+Google Gemini Also Escaped Its Testing Environment And Hacked Three Companies Financial Times1w+Google’s Gemini agents hacked three companies in new AI safety incident Forbes1w+Security Researchers Hacked Into OpenAI Using Anthropic’s Claude Fortune1w+Three guys using Anthropic’s Claude hacked into OpenAI and accessed its source code for $6,500 reward | Fortune IBTimes1w+Hackers Used Anthropic's Claude to Break Into OpenAI. They Reached the ChatGPT Maker's Private Code.Jerusalem Post1w+Gemini hacked three companies in first known breakout by Google's AI Reuters1w+Gemini hacked three companies in first known breakout by Google's AI, WSJ reports Sky News1w+Google's Gemini AI hacks three other companies during security test Times of Israel1w+Google says its Gemini AI broke out and hacked three companies during testing WESH 2 News1w+Google Gemini AI model hacks three other companies WGAL 81w+Google Gemini AI model hacks three other companies

Left coverage, 11 sources: The left frames the breach as evidence that AI development is outpacing safety guardrails, connecting it to OpenAI's recent disclosure of other concerning AI behaviors and broader calls for a slowdown.

The Guardian1w+Google says its Gemini AI model hacked three other companies TechCrunch1w+Google’s Gemini is the latest AI model to hack other companies | TechCrunch Gizmodo1w+Google's Gemini Hacked Three Companies in May, and It's Only Admitting That Now NBC News1w+Google says its AI model gained unauthorized access to three outside systems The Independent1w+Google’s AI model hacked three other companies during security breach The Verge1w+Gemini went rogue, hacked three companies, and Google hid it Al Jazeera1w+Google’s Gemini AI hacks 3 companies in security test, then stops Business Insider1w+This tiny cybersecurity startup managed to hack OpenAI using Claude CBS News1w+AI security experts say they used Claude to hack ChatGPT CNN1w+Gemini hacked three companies in first known breakout by Google’s AI The New York Times1w+Gemini AI Hacked Three Companies in a Testing Breakout, Google Says

Right coverage, 8 sources: The right focuses on the technical mechanics of the attack and treats the Hugging Face incident — attributed to OpenAI's own uncontrolled agents — as the more alarming story, framing calls for AI oversight skeptically.

ZeroHedge1w+Researchers Used Claude To Hack OpenAI Employee Accounts New York Post1w+Gemini AI guessed passwords, accessed protected systems of 3 companies Newsmax1w+Google's Gemini Hacked 3 Companies During Test BizPac Review1w+Google says its AI model accessed internet, hacked three outside systems on its own Citizen Free Press1w+Claude hacks its main AI competitor.The Blaze1w+China’s hackers are hiding in plain sight The Gateway Pundit1w+Woke Google’s Gemini AI Goes Rogue, Hacks Three Real Companies During Cybersecurity Test — Google Did Not Publicly Disclose Incidents for Months * The Gateway Pundit * by Jim Hᴏft The Sun1w+Fears AI bots will break out of test labs AGAIN & unleash cyberhack spree on UK government as tech gets ‘out of control’

What’s next: OpenAI narrowed sign-in token permissions and revoked affected sessions within 14 hours of Hacktron's report.

Discourse patched the image-processing vulnerability and added stronger isolation around image handling.
How much sensitive code, if any, was exposed to the researchers before they halted testing?
Would the same attack chain work against organizations with less security investment than OpenAI?
What restrictions, if any, should apply to AI models capable of generating working exploits?