Researchers used Claude to breach OpenAI employee accounts in under 72 hours

What happened

A three-person independent security team that goes by Hacktron says it compromised OpenAI employee accounts in less than 72 hours, with Anthropic's Claude models doing a significant share of the work. According to The Verge, citing the Wall Street Journal, the researchers used Claude Opus 4.8 and Claude Opus 5 as offensive tooling and eventually reached OpenAI's GitHub repository, known as "Monorepo" — a codebase that the Journal's sources say holds the company's algorithmic secrets.

The researchers stopped short of reading the internal code inside Monorepo. Instead, they demonstrated the breach by submitting a pull request from an OpenAI employee's Codex account, proving they controlled the account without exposing the repository's contents.

How the attack chain worked

The breach did not start at OpenAI's own infrastructure. Its entry point was Discourse, the third-party service that hosts OpenAI's community forums, and specifically a flaw in how the platform processes HEIF images, a modern image format common on smartphones.

The timeline is the striking part. As The Verge reports, Claude Opus 5 became available on the evening of July 24, and by 10AM the next morning the team had used it to achieve remote code execution on Discourse Cloud and reach OpenAI's instance of the software. From there, the chain extended to employee accounts and on to the Monorepo.

A reusable, cheap technique

Hacktron named the effort "HEIF Heist," and it was not built specifically for OpenAI. The team says adapting the technique to a different company took only one or two days, and they aimed it at Slack, Meta, GitHub Enterprise, Rails, Next.js, ImageMagick and other targets. The entire campaign consumed less than $3,000 in model tokens.

Detection was nearly nonexistent. To the researchers' knowledge, only one target — Shopify — noticed the activity.

Disclosure and payout

The vulnerabilities were reported to Discourse and OpenAI and have since been fixed. OpenAI paid Hacktron a $6,500 bounty for the bug.

Hacktron CTO Mohan Pedhapati offered a sober framing in comments to the Journal: "I don't think we are as strong as Chinese threat actors… We're just three guys with Claude and Codex subscriptions."

Why it matters

The story is a concrete data point in the running debate over how far AI assistants accelerate offensive security work. Three researchers, commodity AI subscriptions and a budget smaller than most conference travel were enough to reach the perimeter of one of the most closely watched companies in technology — not by breaking its core defenses, but by walking in through a third-party dependency.

Two implications follow. The first is economic: the scarce resource in sophisticated attacks has traditionally been expertise, and frontier models appear to be converting that scarcity into a modest compute bill. The second is architectural: the attack surface of an AI lab includes everything it depends on — forums, SaaS platforms, image-processing pipelines — and the chain is only as strong as its least-audited link.

The mitigating factor is that this ended as a responsible disclosure, a pull request submitted as proof and a bounty paid out. The same chain, run by someone with different intentions, would not have ended that way — and the fact that only Shopify detected anything suggests most targets would never have known.