How Three Researchers Used Claude to Break Into OpenAI in Under 72 Hours
Three independent security researchers at Hacktron compromised OpenAI employee accounts in less than 72 hours using Anthropic's Claude Opus 4.8 and Claude Opus 5.
The operation was first detailed in a Wall Street Journal exclusive titled "Hackers Used Anthropic's Claude to Break Into OpenAI" and was covered on September 18, 2026 by TechCrunch, Forbes, The Guardian and others. The Wall Street Journal
Initial access did not come through OpenAI infrastructure directly. The researchers entered via Discourse, the third-party service that hosts OpenAI's community forums, by exploiting a flaw in its HEIF image processing system. HEIF is a common photo format used by many phones. The Verge
Hacktron described the chain in its "Hacking OpenAI" blog post and on X as a HEIF upload leading to a heap overflow in libheif (a memory-handling error in an image library) leading to RCE, or remote code execution, which means the ability to run commands on a server. From that foothold, the chain moved from an OpenAI SSO flaw, a weakness in single sign-on, the one-login system that connects services, to ChatGPT and Codex account takeover to connected GitHub access to an internal pull request, a proposed code change. Hacktron
Speed was central to the account. Claude Opus 5 launched in the evening on July 24th, and by 10AM the next day Hacktron had used it to achieve RCE on Discourse Cloud and access OpenAI's instance. Hacktron stated on its official X account that its team hacked OpenAI on July 25.
Once inside the connected GitHub environment, the researchers reached Monorepo, OpenAI's GitHub repository for code. The Journal, citing its sources, reported that Monorepo contains OpenAI's algorithmic secrets. The researchers said they did not access internal code in Monorepo themselves but sent a pull request from an employee's Codex account to show access.
The OpenAI intrusion was part of a wider program Hacktron calls HEIF Heist. The team said it adapted the HEIF-based technique to targets including OpenAI, Slack, Meta, GitHub Ent, Rails, Next.js and ImageMagick in one or two days each, using less than $3,000 in tokens, the units used to measure AI model use. To Hacktron's knowledge, only one target, Shopify, detected the activity.
The vulnerabilities Hacktron reported to Discourse and OpenAI have been fixed. OpenAI paid Hacktron $6,500 for finding the bug. Hacktron CTO Mohan Pedhapati told the Journal his three-person team was less capable than Chinese threat actors, describing the effort as the work of three people with Claude and Codex subscriptions.
The broader context here is what changes when AI makes exploit development much faster. The heap overflow in libheif and the SSO misconfiguration were conventional types of weakness. What was different was iteration speed, with a newly released frontier model turned within hours into working RCE against a managed cloud service, then moved through identity and OAuth trust relationships, the approved links between apps, into ChatGPT, Codex and GitHub. For defenders, the trust boundary was not the primary application but the forum, the image parser and the connected account.
In my view, enterprise security teams should weigh cost and detection as much as brand names. Less than $3,000 in tokens for multi-target work and a single detection across the set points to an imbalance that favors testing at scale. That is reason to treat third-party SaaS integrations, community platforms and SSO session inheritance as primary attack surface, with stricter limits on connected GitHub apps, short-lived tokens and anomaly detection on pull request and Codex actions. Done well, the same automation that enabled HEIF Heist gives defenders a repeatable way to find and fix this class of issue before it reaches Monorepo equivalents elsewhere.
