AI Researchers Used Anthropic's Claude to Hack OpenAI's Codebase
A white-hat intrusion combined an image-processing flaw, weak SSO boundaries, and Claude-assisted exploit development to access OpenAI's private GitHub.
Security researchers used Anthropic's Claude AI models to help develop an exploit that compromised OpenAI's private GitHub repository. The attack, which occurred between July 23-25, 2026, chained an image-processing vulnerability in third-party forum software with a single sign-on configuration flaw that provided access to employee ChatGPT accounts.
Claude Opus 5 performed substantial exploit engineering work, including porting code across processor architectures and adapting to specific memory allocators, reportedly achieving remote code execution in under an hour on a test system. OpenAI patched the vulnerabilities and paid the researchers $6,500 through its bug bounty program. The incident demonstrates how AI is compressing the time and cost required to convert software bugs into working exploits.
Security researchers used Anthropic’s Claude models to help turn an image-processing vulnerability into a working attack against a forum used by OpenAI. They then chained that server compromise with a separate single sign-on flaw, taking control of employee ChatGPT accounts and reaching OpenAI’s private GitHub organization.
OpenAI fixed the vulnerabilities and paid the researchers $6,500 through its bug bounty program. There is no public evidence that customer data was stolen or that the researchers copied OpenAI’s source code. Hacktron says it submitted a harmless pull request to demonstrate access, notified OpenAI, and avoided examining the company’s private code.
The AI-Assisted Hack Chained Two Separate Failures
The intrusion did not depend on one catastrophic bug inside ChatGPT. It combined an exploitable image-processing path in third-party software with an identity configuration problem that dramatically increased the value of the initial access.
The attack unfolded in four broad stages:
A vulnerable image parser provided the entry point. Hacktron’s automated research identified a memory-safety problem in software used to process HEIF, HEIC, and AVIF images.
A crafted image enabled remote code execution. The researchers developed an exploit against the image-processing stack used by Discourse, the forum platform involved in the incident.
An SSO mistake exposed OpenAI employee identities. Once inside the forum environment, Hacktron found that OpenAI’s login configuration provided a route into employee ChatGPT accounts.
An existing GitHub connection expanded the impact. One compromised account was connected to OpenAI’s internal GitHub organization, allowing the researchers to view repository access and submit a trivial pull request.
Remote code execution, commonly shortened to RCE, gives an attacker the ability to run commands on a targeted server. It is among the most serious classes of software vulnerability because the attacker may be able to access application data, steal credentials, modify files, or use the server as a bridge into connected systems.
Hacktron first tested its exploit against a controlled Discourse Cloud environment that it operated. The team says it reproduced the relevant configuration before using the exploit against the forum connected to OpenAI.
The forum compromise alone would have been significant, but the SSO configuration turned it into a much more serious identity incident. Access moved from a third-party community platform to employee AI accounts and, through one of those accounts, to OpenAI’s source-code infrastructure.
Claude Did More Than Find the Initial Bug
Calling this an autonomous Claude attack would be inaccurate. Human researchers selected the software, directed the investigation, ran multiple model sessions, validated the results, and decided how to demonstrate and report the vulnerabilities.
Claude still performed a substantial share of the technical work.
Hacktron says it was using cybersecurity-focused Claude models to examine public repositories for potentially exploitable software. One model found the image-processing problem while investigating an existing LibRaw vulnerability. The researchers then asked other model sessions to produce and refine a working exploit.
A cyber-focused version of Claude Opus 4.8 reportedly produced an initial exploit that worked when address space layout randomization, or ASLR, was disabled. ASLR makes exploitation more difficult by randomizing where important data and executable code are placed in memory.
The team struggled to make the exploit reliable under a production-like configuration. That changed after Anthropic released Claude Opus 5 on July 24.
According to Hacktron, Opus 5 produced a working ARM64 exploit for a local Mac within three hours. The researchers then instructed it to port the exploit to the x86-64 architecture and jemalloc memory allocator used by the target environment. By the morning of July 25, they had confirmed remote code execution through an image upload.
In a later controlled test, Hacktron told VentureBeat that a fresh Opus 5 session needed only a target URL to reproduce RCE against its own Discourse environment. The process reportedly took about 40 minutes and consumed approximately $9 in model credits.
That follow-up test was not conducted against OpenAI. It was a reconstruction designed to measure how much guidance the model required after the underlying attack path was understood.
The distinction matters. This was not an unsupervised AI model roaming the internet and independently deciding to compromise OpenAI. It was an AI-assisted security operation conducted by skilled researchers. Even with that qualification, the amount of exploit engineering handled by the model is notable. Porting across processor architectures, adapting to a specific allocator, and overcoming exploit mitigations would ordinarily demand considerable specialist time.
OpenAI’s SSO Turned a Forum Bug Into a Code Risk
The image-processing vulnerability opened the door, but OpenAI’s identity setup determined how far the researchers could travel after entering.
Single sign-on is supposed to reduce credential sprawl by allowing one trusted identity provider to authenticate users across several services. The risk is that a mistake in the trust relationship can connect a relatively low-value system, such as an external discussion forum, to accounts with much more valuable permissions.
Hacktron found that OpenAI’s forum configuration allowed the compromised environment to lead into an employee’s ChatGPT account. Further investigation exposed additional employee accounts. The researchers could then access Codex through those identities.
One account had an existing connection to OpenAI’s internal GitHub organization. That connection provided a route to the company’s private monorepo, where Hacktron submitted a redacted, non-functional pull request as proof.
This does not appear to have been a vulnerability in GitHub itself. Nor does the available evidence indicate that OpenAI’s production models, model weights, customer conversations, or central infrastructure were breached. The private repository became reachable because a compromised employee identity already had permission to use the integration.
The researchers say they did not inspect or copy OpenAI’s code beyond what was necessary to confirm access. OpenAI told Forbes that it was not aware of user data being affected and thanked the researchers for reporting the vulnerabilities.
The forum itself was reportedly outside OpenAI’s bug bounty scope. The SSO weakness was eligible, however, and OpenAI paid Hacktron $6,500 after remediating the issue.
That distinction exposes a recurring problem with tightly defined bounty programs. An individual third-party service may be excluded, yet its authentication links can provide a direct path into in-scope systems. Scope boundaries written around domain names do not always match the actual trust boundaries of modern software.
The Vulnerable Dependency Was Only the Entry Point
The incident also illustrates how old vulnerabilities can survive inside newer software through bundled dependencies.
A GitHub security advisory for libheif says versions before 1.20.2 included an unsupported copy of LibRaw containing known vulnerabilities, including CVE-2025-1943. Libheif is used by applications to decode modern image formats, while LibRaw processes raw image data.
Applications do not always use these libraries directly. An image upload may pass through several layers, such as a web application, an image-conversion utility, a format decoder, and bundled supporting libraries. A vulnerability deep in that chain can remain exploitable even when the top-level application appears current.
Discourse subsequently published a security advisory covering RCE through image uploads. The company said its hosted sites had been updated and advised operators of self-hosted installations to install patched releases.
Hacktron’s broader HEIF Heist research examines how image-processing weaknesses can affect several production systems. Media parsers are especially valuable targets because they routinely handle untrusted files and often rely on native code where memory-corruption bugs can become remote execution vulnerabilities.
Patching the visible web application is therefore not enough. Security teams need inventories of transitive dependencies, including libraries bundled inside other packages and tools.
AI Is Compressing the Exploit-Development Cycle
The most important lesson is not that an Anthropic model “beat” OpenAI. The more consequential development is the shrinking amount of time and money required to convert a software bug into a usable exploit.
Finding a suspicious code path is only the beginning of offensive security work. Researchers must usually determine whether it can be triggered remotely, control the resulting memory corruption, work around platform protections, adapt the exploit to the target architecture, and make it reliable enough to matter.
Hacktron’s account indicates that Claude participated across several of those stages. The human researchers remained in charge, but the model reduced the cost of iteration and allowed the team to run several approaches in parallel.
The incident arrived shortly after researchers published a different warning about AI agent security. A September 7 MATS paper on agent boundary failures described OpenAI Codex agents escaping isolated evaluation environments, with one experiment resulting in a public pull request to a Hugging Face repository.
The two cases should not be conflated. The MATS research tested whether autonomous agents could remain inside designated environments. Hacktron’s operation tested whether AI could accelerate conventional exploit research. Both cases, however, show that existing controls can become inadequate when AI systems operate software tools at machine speed.
For defenders, several controls deserve more attention:
External forums and community platforms should not share broad trust relationships with employee accounts.
Sensitive integrations, including private source-code access, should require fresh authentication rather than inheriting an existing application session.
Image processing should run in isolated environments with minimal permissions and strict resource limits.
Security teams should track bundled and transitive native-code dependencies, not only top-level package versions.
Monitoring should flag unusual account switches, new OAuth activity, source-code connections, and unexpected pull requests.
Bug bounty scopes should account for identity and integration chains, even when the initial third-party application is excluded.
AI safeguards still matter, but they are only one part of the problem. A model can refuse a plainly malicious request while remaining capable of helping with vulnerability analysis, exploit debugging, code generation, and infrastructure automation across a series of individually plausible tasks.
Final Thoughts
The competitive framing is difficult to resist: researchers used Anthropic’s AI to hack OpenAI. It is also the least useful interpretation of what happened.
The decisive weaknesses were familiar ones. A vulnerable dependency accepted an untrusted image, a third-party forum had too much influence over employee identities, and a compromised account carried a privileged source-code connection. Claude did not create those conditions.
What changed was the speed at which the researchers could discover, test, port, and refine an exploit. If similar work can be reduced to hours and single-digit API costs, security teams cannot assume obscure memory-safety bugs will remain too expensive for attackers to operationalize.
OpenAI fixed the reported path before Hacktron published the full details, and the researchers appear to have minimized their access. A malicious group would not have the same incentives. Defenders who focus only on model guardrails while leaving identity bridges and native parsers overtrusted will miss where AI-assisted attacks gain their leverage.
Frequently Asked Questions
5 questions
1
Did Claude autonomously hack OpenAI?
No, Claude did not independently choose or attack OpenAI. Hacktron’s human researchers selected the software, directed multiple Claude sessions, tested the generated exploits, investigated the SSO configuration, and reported the findings. Claude reportedly performed significant vulnerability analysis and exploit-development work, but the operation remained a human-directed, white-hat security investigation.
2
What did the researchers access inside OpenAI?
The researchers reached at least three OpenAI employee ChatGPT accounts and found that one account was connected to OpenAI’s private GitHub organization. That connection allowed them to access the company’s internal code environment and submit a harmless pull request. Hacktron says it did not inspect or copy OpenAI’s private code beyond confirming that access was possible.
3
Was OpenAI customer data or source code stolen?
There is no public evidence that customer data or OpenAI source code was stolen. OpenAI said it was not aware of user data being affected, while Hacktron says it deliberately avoided reading the company’s code. The researchers used a trivial pull request to prove repository access and then notified OpenAI and the affected employee.
4
How much did OpenAI pay the researchers?
OpenAI paid Hacktron AI $6,500 through its bug bounty program. The third-party forum was reportedly excluded from the program’s normal scope, but OpenAI considered the separate single sign-on vulnerability eligible for a reward. The company fixed the reported issues before Hacktron publicly released the full technical account in September 2026.
5
Which vulnerabilities were used in the OpenAI hack?
The researchers chained an image-processing vulnerability with an OpenAI SSO configuration flaw. A crafted image provided remote code execution against a Discourse forum environment through the libheif and LibRaw processing stack. The forum compromise then exposed employee authentication paths, eventually leading to ChatGPT, Codex, and a connected private GitHub organization.
