Hacktron says Claude helped three researchers breach OpenAI

Security startup Hacktron AI says three of its researchers gained access to OpenAI’s private codebase in under 72 hours, with help from Anthropic’s Claude. The attack, covered in The Rundown, started with an image upload bug in OpenAI’s community forum.

Hacktron published the findings on September 13, describing work from July 23 to 25. TechCrunch reported on September 18 that OpenAI said the issues had been fixed.

How the researchers got in

The researchers say a flaw in libheif, an image processing library, let them run code on the Discourse system hosting OpenAI’s community forum. A second flaw in OpenAI’s login system let staff tokens also unlock their ChatGPT accounts.

From there, they say they directed Codex to propose a change to an internal documentation file in OpenAI’s private GitHub environment. They had already filed an initial report and then updated it with the demonstration.

Hacktron says its OpenAI report earned a $6,500 bounty on September 1. Forum testing fell outside OpenAI’s bounty scope. The researchers said they did not read or download private source code, according to The Indian Express.

Discourse’s July 28 security advisory confirms the image upload vulnerability and tells operators to rebuild with a patched Docker image.

Where Claude helped

Hacktron says Opus 5 finished the exploit within a day of its July 24 release, after a specialist configuration of Opus 4.8 stalled on the task. The underlying Opus 4.8 model was broadly available.

Anthropic’s Opus 5 announcement says standard safeguards block penetration testing and exploit generation, while Cyber Verification Program participants receive access with fewer restrictions. The exact Opus 5 access settings behind Hacktron’s result remain unclear.

Why it matters

Hacktron CTO Mohan Pedhapati told The Wall Street Journal, in a quote reported by The Indian Express, “We’re just three guys with Claude and Codex subscriptions.” That description may undersell the team’s skill. Hacktron says the work required skilled human guidance.

The concern is how much more that expertise can produce with AI help. Hacktron puts AI token spending for its broader campaign spanning two months below $3,000. That covers more than the OpenAI incident and leaves out labor, infrastructure and prior expertise. A larger malicious group could pursue more targets at once or keep working on attacks it might otherwise abandon.

The reported route from employee accounts to Codex also raises the stakes for companies that connect AI assistants to private repositories. A compromised account could give an attacker the permissions attached to those tools. Narrower repository access and separate approval for code changes could limit the damage, though added approvals may slow legitimate work. Hacktron’s proposed documentation edit leaves open whether an attacker could get a harmful change approved and deployed.

For forum operators, Discourse’s rebuild instructions show why patching has to reach the image processing software inside deployed containers. Teams should check those dependencies and isolate the tools that handle untrusted uploads.

Hacktron’s reported shift from a stalled exploit to success after a model release adds another concern. Better tools may make an existing flaw easier to exploit. One reported attempt gives no reliable comparison of the models’ success rates. How much further a larger malicious group could take that assistance remains an open question.