Hacktron's researchers gave Claude Opus 5 two chained flaws and the model walked them into the ChatGPT and Codex accounts of OpenAI employees, reaching an internal environment past account takeover. Google ran a parallel evaluation and reported Gemini doing the same against a different company's systems during a security test, reaching the internet and pivoting from there. Both are vendor-run exercises, not incidents disclosed by a victim. The distinction matters because a vendor-run test picks its own stopping point.

What changed is the exploit operator. The two flaws Hacktron chained are the kind that used to require a human with time on a keyboard: an authentication weakness paired with a privilege escalation, worked in sequence until the session belonged to someone else. Model chaining, not the individual bugs, is why researchers who broke into OpenAI this summer are now telling reporters at the Washington Post that the industry is not built for AI systems attacking AI systems. The distance between "the model can chain two known flaws" and "the model can chain two flaws it just found" is one training run, and nobody in either test claims to know how far that run is.

The named artifacts are Claude Opus 5 and Gemini, run by Hacktron and by Google's own red team, against OpenAI's account infrastructure and an unnamed company's live systems, respectively. Neither report names a CVE, because neither test disclosed a vendor flaw. It disclosed a capability: a frontier model executing an intrusion chain end to end, with a human choosing the target and reading the output.