Researchers Used Claude to Break Into OpenAI Accounts in Just 72 Hours

Three independent security researchers say they used Anthropic’s Claude models to break into OpenAI employee accounts in less than three days, exposing how quickly AI tools can be turned into offensive hacking assistants. The researchers say they reached OpenAI’s GitHub repository, demonstrated access with a pull request, and then disclosed the flaws so they could be patched.

The episode matters because it shows that frontier chatbots are no longer just productivity tools or coding aids; they can also accelerate real-world intrusion work when paired with a target’s vulnerable third-party software. It also underscores a broader security problem for AI firms: their own internal systems can be exposed through external services they do not fully control.

What happened in the OpenAI intrusion?

Researchers from the security group Hacktron say they used Claude Opus 4.8 and Claude Opus 5 to compromise OpenAI employee access by exploiting a weakness in Discourse, the forum platform OpenAI uses for community discussions. According to reporting from the Wall Street Journal, the team was able to move from an initial entry point to OpenAI-linked systems in under 72 hours.

The group did not claim to steal source code from OpenAI’s internal repository, known as Monorepo, but it says it proved the access was real by sending a pull request from an employee’s Codex account. That demonstration was enough to show the intrusion had reached a sensitive internal environment associated with OpenAI engineering work.

OpenAI and Discourse have since fixed the vulnerabilities the researchers reported, and Hacktron says OpenAI paid a $6,500 bug bounty for the discovery.

Why the forum software mattered

The researchers say the path into OpenAI began not with OpenAI’s own core systems, but with Discourse, which hosts the company’s public-facing forums. That kind of setup is common in large technology companies, where internal identity systems, support portals, and community platforms are interconnected enough that one weak link can expose more sensitive services.

Hacktron says the attack chain relied on a flaw in how the forum software handled HEIF image files. By using a corrupted image file, the team says it was able to trigger remote code execution on Discourse Cloud and then reach OpenAI’s instance. In practical terms, that means a file upload pathway that should have been routine became a doorway into a much larger environment.

Hacktron’s CTO, Mohan Pedhapati, told the Wall Street Journal that the team was not claiming to be more capable than major state-backed attackers. He described the group as “just three guys with Claude and Codex subscriptions,” while saying the exercise showed how accessible powerful offensive tooling has become.

How did Claude speed up the hack?

Claude appears to have acted as a force multiplier, helping researchers rapidly adapt the attack to multiple targets and software stacks. Hacktron says the same technique, which it calls the “HEIF Heist,” could be adjusted in only a day or two for companies and tools including OpenAI, Slack, Meta, GitHub Enterprise, Rails, Next.js, and ImageMagick.

The group says the work cost less than $3,000 in token usage, which highlights a striking asymmetry: what once might have required a dedicated team and significant manual effort could now be prototyped with consumer AI subscriptions and a modest budget. That does not mean the models independently “hacked” OpenAI, but it does suggest they materially reduced the time needed to research, test, and refine exploit paths.

What the researchers say they did with the models

According to the account reported by the Wall Street Journal, Claude helped the team process the attack chain from vulnerability discovery to exploitation. The researchers appear to have used the model for guidance, iteration, and adaptation, rather than relying on it as a fully autonomous agent.

That distinction is important. The story is not that Claude woke up and breached OpenAI on its own. Instead, the incident shows how capable AI systems can dramatically compress the skill gap for human operators who already understand security testing, exploit chaining, and the mechanics of web infrastructure.

Why this breach is a warning for AI companies

This incident is a reminder that AI companies are now high-value targets in the same way major cloud and software vendors have long been. Their systems contain proprietary model code, internal tooling, customer data, and product road maps, all of which can be valuable to attackers or competitors.

It also highlights a growing contradiction in the AI industry. The same models being marketed as assistants for coding, research, and customer support can also be used to accelerate offensive security work. As these tools become more capable, the barrier between legitimate security testing and weaponized reconnaissance grows thinner.

Security teams have long worried about supply-chain exposure, but the OpenAI case makes that risk more concrete. A vulnerability in an externally hosted service, especially one connected to authentication or support workflows, can become the shortest path into an otherwise hardened enterprise.

What is Monorepo and why was it important?

Monorepo is the name reportedly used for OpenAI’s GitHub repository containing internal code and related assets. The Wall Street Journal described it as holding “algorithmic secrets,” underscoring why access to it would be sensitive even if the researchers say they did not browse internal source directly.

In software companies, a monorepo often centralizes large portions of product code, shared libraries, and infrastructure tooling. Even partial access can reveal architecture, naming conventions, deployment patterns, and internal dependencies that help an attacker understand how a company builds and secures its systems.

What is the HEIF Heist project?

HEIF Heist is Hacktron’s name for the research project that uncovered the vulnerability chain. The project focused on a class of issues tied to HEIF image processing, demonstrating how a file format that is normally associated with everyday mobile photography could be leveraged in a security exploit.

The researchers say they tested the approach against multiple organizations and development tools, adjusting it in one or two days per target. They also said only one company, Shopify, appears to have detected their activity during those tests, a claim that raises questions about visibility into sophisticated but low-cost intrusion attempts.

The broader implication is not just that one platform was weak, but that security pipelines may be struggling to identify fast-moving, AI-assisted adversaries who can customize attacks quickly enough to stay under the radar.

How serious was the compromise?

The compromise was serious enough to warrant a bug bounty payout and emergency fixes, but it does not appear to have resulted in public disclosure of source code or customer data. Hacktron says it stopped once it had proven access and filed the vulnerability reports.

That makes the case a responsible disclosure story rather than a breach scandal, but it is still significant. The key issue is not the amount of damage done; it is how quickly the access was achieved and how little it cost.

In security, speed matters. If a small team can reach privileged internal systems in about two days using commercial AI tools, then malicious actors can potentially do the same—possibly with greater persistence, secrecy, and intent.

Why this matters beyond OpenAI

The OpenAI case is likely to interest defenders across the tech industry because the same pattern can repeat anywhere companies rely on a patchwork of third-party products, identity integrations, and automated developer tools. If a forum package, code hosting platform, or image parser sits on the edge of a sensitive network, that edge becomes a target.

It also shows that AI security discussions can no longer focus only on model alignment, hallucinations, or content moderation. Operational security, access control, and infrastructure hygiene now matter just as much. Powerful models create new efficiencies for defenders, but they also lower the cost of sophisticated probing by attackers.

How should companies respond?

Companies should assume that AI-assisted attackers can move quickly, test more ideas, and adapt exploit chains faster than before. That means harder scrutiny of third-party services, tighter identity boundaries, better logging, and more aggressive patch management for file parsers, media handlers, and authentication-adjacent systems.

• Audit all external services connected to internal accounts and repositories.
• Review file-upload and image-processing workflows for memory corruption or code execution risks.
• Limit what a compromised forum or support system can reach.
• Monitor for unusual account actions, especially code repository activity.
• Assume AI tools can accelerate both vulnerability research and exploit refinement.

What does this say about Claude, OpenAI, and AI security?

It says the security conversation has entered a new phase. Claude was not the attacker, but it was part of the tooling stack that enabled a small research group to operate more like a larger one. That is a profound shift for an industry that sells intelligence as a productivity edge.

For Anthropic, the episode is a reminder that model capabilities can be used in ways that stretch beyond the company’s intended use cases. For OpenAI, it is a reminder that even a leading AI firm can be vulnerable to ordinary web and infrastructure weaknesses. For the rest of the industry, it is a warning to tighten defenses before a similarly inexpensive attack chain is used maliciously.

As AI systems continue to improve, the line between security research, red teaming, and real-world intrusion will only get harder to manage. The OpenAI incident suggests the next era of cyber risk may not be defined by one breakthrough exploit, but by how quickly AI helps people discover and operationalize the old ones.

Timeline of the reported incident

The following sequence summarizes the events described by Hacktron and reported by the Wall Street Journal.

1. July 24, evening: Claude Opus 5 is launched for the researchers’ testing workflow.
2. Within about 12 hours: The team says it achieves remote code execution on Discourse Cloud.
3. By the next morning: OpenAI’s instance is accessed through the Discourse path.
4. Within 72 hours total: The researchers demonstrate access to OpenAI-linked systems.
5. After disclosure: The vulnerabilities are patched and a bug bounty is paid.

The bigger takeaway

The OpenAI hack is not just a story about one company’s vulnerability; it is a case study in how modern AI can shrink the time and cost required to find and exploit weaknesses in complex software ecosystems. The fact that a three-person team says it did this with consumer-accessible AI subscriptions should concern anyone responsible for defending large digital systems.

In the near term, the industry will likely treat this as a red-team success and a patching win. In the longer term, it may be remembered as another sign that the tools companies are racing to build are also changing the attacker’s playbook faster than many defenders expected.