Claude Opus 5 enabled researchers to hack into OpenAI systems

Anthropic's Claude Opus 5 helped security researchers chain together a multi-step exploit that got them into OpenAI's systems. That is the first documented case of a frontier AI model enabling an intrusion into a direct competitor's infrastructure, and it is going to be hard to un-see.

The mechanism matters. Opus 5 did not find a new vulnerability. It connected known pieces under ambiguity, reasoning across steps where each one is defensible and the combination is the attack. That is a different capability than what current red-team evals measure. The existing "cyber-offense" categories in Anthropic's and OpenAI's scaling policies test for bug-finding. Chaining is harder, subtler, and now publicly demonstrated.

Every safety team at every major lab saw this happen to a named competitor. The cheap, reputation-protecting response is to add a chaining-specific evaluation and say so in the next system card. The cost of one documented eval is low. The cost of being caught flat-footed on this twice is high.

The call: before June 2027, at least one of OpenAI, Anthropic, or Google DeepMind publishes a safety or system card that names multi-step exploit chaining as a distinct tested capability. Medium confidence. The incentive is clearly there; the only risk is timing against a specific release window.

Prediction: Before June 2027, within the release windows of the next frontier models from OpenAI, Anthropic, and Google, at least one lab will ship a documented pre-deployment evaluation specifically for multi-step exploit chaining as part of its published safety or system card, where none exists in that form today.

Confidence: Medium. The incentive to be seen testing this is strong, but timing across a specific release is the risk.

Why: This case gave the dual-use debate its first clean before/after data point, and it landed against OpenAI itself, which guarantees it circulates inside every lab's safety team. Labs already publish system cards that describe what they red-teamed, and "cyber-offense" is already a named category in Anthropic's and OpenAI's scaling policies. The gap this exposed is that the existing tests measure finding bugs, not chaining known pieces under ambiguity, which is the harder skill Opus 5 demonstrated. The cheap, reputation-protecting move is to add a chaining-specific test and say so in the next card. The opposite outcome, every lab staying silent on this axis after a public embarrassment tied to a named competitor, is the less likely one because the cost of adding one documented eval is low and the cost of being caught flat-footed twice is high.

Revisit by 2027-06-01: We're right if OpenAI, Anthropic, or Google DeepMind publishes a safety or system-card evaluation naming multi-step exploit chaining (or equivalent offensive-chaining) as a distinct tested capability. We're wrong if the next frontier system cards from all three cover cyber-offense only at the current find-a-bug granularity with no chaining-specific test named.