Three Researchers Used Claude Opus 5 to Reach OpenAI’s Internal Code
A three-person team at security startup Hacktron AI used Claude to develop an exploit chain that reached OpenAI employee ChatGPT accounts and a private code repository, then proved it by opening a harmless pull request. Total elapsed time from first look to repo access: under 72 hours. OpenAI paid a $6,500 bounty through Bugcrowd.
Neither underlying bug was exotic. The chain started at an image upload feature on OpenAI’s community help forum, which runs on Discourse. A safety filter that was supposed to screen uploads simply did not recognize certain photo formats and let them through. Those files then landed in a separate image-processing library carrying a known memory-corruption flaw. Add an identity-configuration gap and two unremarkable weaknesses compound into access neither had on its own.
The detail worth sitting with is the model dependency. The researchers say an earlier Claude model could not produce a reliable exploit for the target environment. Once Claude Opus 5 was available, they had a working ARM64 exploit within hours. That is a capability threshold being crossed in public, documented by the people who crossed it, with a bug bounty receipt attached. OpenAI patched both issues in roughly 14 hours.
Anthropic’s September Threat Intelligence Report Covers Nine Months of Disruptions
Anthropic published its September 2026 threat intelligence report, covering operations its Threat Intelligence team identified and disrupted between December 2025 and August 2026. The taxonomy spans seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation — that last one meaning people using Claude to train competing models.
The format is case studies rather than aggregate counts, which is the more useful choice: it shows how malicious use has evolved rather than just how much of it there is. Anthropic says it disrupted the activity in each case and shared intelligence with authorities and industry partners where appropriate.
One line in the report deserves more attention than it will get. The disrupted cases involved Claude Haiku, Sonnet and Opus — with no misuse cases involving Fable or Mythos-class models except a single illicit distillation case. Read charitably that is access controls working on the frontier tier. Read skeptically it is a statement about who currently has access to what, not about what those models would do if asked.
The Sonnet 5 Price Increase That Was on the Calendar Is Not Happening
Quietly and in everyone’s favor: the introductory pricing for Claude Sonnet 5 — $2 per million input tokens and $10 per million output — is now the standard price. The scheduled increase to $3/$15 on September 1, 2026 will not occur.
That is a 50% increase that a lot of teams already modeled into Q4 budgets, sometimes as a reason to shift volume toward Haiku or to cap agent loop depth. If you built a mitigation plan around the September 1 date, the mitigation is no longer necessary. Worth checking whether anyone on your team routed traffic away on that assumption and never routed it back.
The strategic read is straightforward. Sonnet 5 is the workhorse tier, and holding it at intro pricing after the intro period is a volume play against a market where per-token cost is the main procurement lever left. Nobody switches providers over model quality anymore; they switch over invoices.
2.1.277 Reads AGENTS.md, and 2.1.278 Stops Charging You for Auto Mode
Claude Code 2.1.277 adds something the community has been asking for since the format started spreading: in a project with no CLAUDE.md, Claude Code now reads AGENTS.md instead. If you maintain one agent-instructions file across multiple tools, you no longer need a duplicate with a different name sitting next to it.
The same release moves Bedrock, Vertex, Foundry and telemetry-disabled installs to the v2 MCP client, with MCP 2026-07-28 negotiation against direct HTTP servers by default. It also adds CLAUDE_GATEWAY_PROXY_IS_EGRESS_BOUNDARY=1 for gateway deployments whose only egress is a forward proxy — every outbound request hands the proxy the hostname rather than resolving it locally. And /code-review now uses leaner inline review prompts for any model without tuned settings, instead of spawning a pile of review subagents.
2.1.278 landed today with a change that shows up on your bill. Auto mode now defaults to the server-side classifier for Claude API and Enterprise users, and on Bedrock, Vertex, Foundry and gateways — and the server-side classifier does not charge for classifier overhead. There is a new Auto mode server row in /status so you can confirm which side your session is running on.
MCP Tunnels, the 2026-07-28 Spec, and Where the Connector Story Is Going
The MCP 2026-07-28 specification is now the default negotiation target in more places, and its design goals are worth restating because they explain the last two months of release notes: a stateless core, standardized extensions, and hardened auth. Stateless is the important word — it is what lets a server scale horizontally behind a load balancer without session affinity, which is what enterprise deployments actually need.
MCP tunnels remain in research preview and solve the other half of that problem: connecting Claude to MCP servers inside a private network without exposing them to the public internet, and with no inbound firewall rules. For anyone who has tried to get an internal tool in front of Claude and hit a security review, this is the unlock.
Context on the scale of the connector push: Anthropic shipped more than 20 connectors and 12 practice-area plugins for legal earlier this year, and the September 15 small business update added 43 workflows and 27 connectors covering Shopify, Salesforce, Zoom, Xero, Gusto, Square, Stripe and Zapier. The pattern is clear enough: the model is no longer the product surface, the integration catalog is.
Fourteen Partners, Fourteen Free Webinars, Late September Through November
Anthropic is running a fall webinar series for Claude for Small Business: 14 technology partners each hosting a free webinar from late September through November, where the companies behind the integrations teach owners how to use Claude with their own tools. Alongside it, community-run Claude workshops hosted by Approved Claude SMB Trainers.
This is a distribution move dressed as education, and it is a smart one. The September 15 update added 43 workflows and 27 connectors, which is a lot of surface area for a segment that does not have a platform team to figure it out. Having Shopify explain the Shopify connector beats having Anthropic explain all 27.
The Approved Trainer program is the piece to watch. A certified third-party training tier is how enterprise software ecosystems historically got their reach — and it is the first clear signal that Anthropic is building a partner channel rather than only a direct sales motion.
Claudeforce Open Beta Is Live This Month
Claudeforce — the expanded Salesforce–Anthropic partnership announced August 26 — is expected in open beta during September. The naming alone is the story: this is the first time Salesforce has appended its “force” suffix to another company’s product, which in Salesforce’s internal grammar is close to adoption.
The first shipping product is a Salesforce plugin for Claude with 37 prebuilt sales skills: meeting prep, deal health, pipeline review, email drafting, record updates. That is a well-chosen list — it is precisely the set of tasks reps do badly because they are tedious, not because they are hard.
For anyone evaluating: a prebuilt skill catalog is a very different adoption curve from a blank agent builder. The failure mode of enterprise AI has been the empty prompt box, and 37 named skills is an answer to it.
The Dual-Use Argument Finally Has a Receipt
The dual-use problem in AI security has mostly been argued in the abstract: defenders and attackers get the same tools, the balance is unclear, everyone cites the offense-defense literature and goes home. Today it has a specific, documented, dated instance. An earlier Claude model could not build a working exploit for OpenAI’s target environment. Claude Opus 5 could, in hours. Same researchers, same target, same technique. The only variable was model capability.
What makes it clean rather than alarming is who ran it. Hacktron are security researchers, they disclosed responsibly, OpenAI patched in 14 hours and paid the bounty. The whole thing worked the way the system is designed to work. But the mechanism that made it work is the social layer, not the technical one — the exploit did not care who was driving. Strip out the disclosure norms and the bug bounty program and you have the same 72 hours with a different ending.
The second lesson is more actionable and less discussed: the bugs were boring. A file-type filter that did not recognize certain formats. An old memory-corruption flaw in an image library. An identity-configuration gap. None of these would have made a severity list on its own. What the model contributed was not novel vulnerability discovery — it was the patience and speed to chain three unremarkable weaknesses into one serious one. That is the part security teams should be modeling. Your attack surface is not your worst bug; it is every combination of your mediocre ones, and the cost of searching that combination space just dropped a lot.
Which lands oddly next to today’s other story. Anthropic published a threat intelligence report on nine months of disrupted misuse, and it is a genuinely serious document. It also, by construction, covers only the misuse Anthropic caught. Hacktron were not a disruption case — they were legitimate researchers doing legitimate work, and nothing in the threat-intel pipeline would or should have stopped them. The uncomfortable version of that sentence is that the workflow which produced an OpenAI breach in 72 hours was, correctly, indistinguishable from normal use.