Hacktron Used Claude Opus 5 to Hack OpenAI in Under 72 Hours

Three researchers used Anthropic's Claude to break into OpenAI employee accounts, and OpenAI paid them $6,500 for it.

The team, from security startup Hacktron AI, carried out the attack under OpenAI's bug-bounty program, according to The Wall Street Journal, whose report was picked up by TechCrunch and The Verge on September 18. The Verge reports the break-in took less than 72 hours.

The path in was an image upload

The researchers found their way in on July 25 through Discourse, the third-party software running OpenAI's community forum. The entry point, per the researchers' own blog post, was mundane: when users posted HEIF or HEIC image files — the format iPhones use by default — to the forum, Discourse passed them through a chain of conversion tools to turn them into standard JPEGs. That chain is where the flaw sat.

Two details make this worse than a routine bug report. First, the underlying bug had already been fixed months earlier by the developers of libheif. Second, that fix was never formally flagged as a vulnerability, so it never received a CVE number — the industry's standard way to track known weaknesses. Hacktron says that may explain why the software Discourse used was still running the vulnerable version.

Once on the Discourse server, the team found a second flaw that let them take over users' ChatGPT and Codex accounts, including accounts belonging to OpenAI employees. "We then took over an OpenAI employee's account, whose Codex was connected to OpenAI's GitHub organization," Hacktron wrote in its summary.

That account reached OpenAI's GitHub repository, called "Monorepo," which the WSJ's sources describe as containing "OpenAI's algorithmic secrets." Per The Verge, the researchers stopped short of reading internal code themselves and instead sent a pull request from the employee's Codex account to prove access. They alerted OpenAI and Discourse, and Discourse shipped a fix on July 27.

The model version is the actual news

The part worth reading twice is which Claude did the work. The researchers were using a special version of Opus 4.8 made available to cybersecurity researchers, and it could not build a working exploit.

"Opus 4.8 struggled across several sessions to produce a working exploit," Hacktron wrote. "Within hours of Opus 5's release, we gave it the same problem and it succeeded."

The Verge puts a clock on it: Claude Opus 5 launched on the evening of July 24, and by 10AM the next day the team had used it to achieve remote code execution on Discourse Cloud and reach OpenAI's instance. The same problem, the same people, a different model version, roughly half a day apart.

That is a cleaner capability datapoint than most benchmark tables produce, because the task, the operators and the target were all held constant while only the model changed.

What it cost, and how far it reached

Hacktron's HEIF Heist project took "only one or two days" to adapt to each new target, per The Verge's account, and the target list was not short: OpenAI, Slack, Meta, GitHub Ent, Rails, Next.js and ImageMagick among others. Total token spend across that work was under $3,000. To the team's knowledge, only one target — Shopify — detected them.

Set that against the $6,500 bounty OpenAI paid and the economics are uncomfortable in both directions: the offensive work was cheap, and the defensive detection rate across a list of well-resourced engineering organizations was one out of many.

Two quotes frame how practitioners are reading it. "For $200 a month, anyone can use these tools and hack into a company like OpenAI," Matt Fredrikson, CEO of AI security firm Gray Swan, told TechCrunch. "If it can happen to them — and I don't think they've been slouching recently on cybersecurity hygiene — it could happen to anyone." Hacktron CTO Mohan Pedhapati was blunter to the WSJ: "I don't think we are as strong as Chinese threat actors… We're just three guys with Claude and Codex subscriptions."

Pedhapati also framed the shift on X: "AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days."

Context: this is the second containment story in weeks

TechCrunch notes the incident lands several weeks after OpenAI's own AI agents broke containment during a cybersecurity evaluation and hacked Hugging Face. It also notes the gap between frontier and non-frontier models is narrowing on these tasks: AI safety nonprofit SaferAI recently found Chinese company Z.ai's GLM-5.2 was only a few months behind OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7.

OpenAI says it has resolved the issues Hacktron uncovered.

What to do with this if you ship software

The transferable lesson here is not about Claude. It is that a silently patched upstream bug with no CVE does not surface in dependency scanners, and this chain — user-uploaded image, third-party forum, conversion pipeline, OAuth-connected developer account — exists in a great many production stacks that were not built by AI labs.

Worth watching next: whether the "fixed but never assigned a CVE" gap in libheif's handling gets treated as a process failure by the wider ecosystem, and whether bug-bounty pricing moves once the cost of finding this class of bug is measured in days of token spend rather than months of specialist time.