Security researchers used Claude to help them hack into OpenAI

A trio of independent researchers affiliated with Hacktron reported to The Wall Street Journal that they used Anthropic’s Claude Opus models (versions 4.8 and 5) to penetrate OpenAI employee accounts and reach the company’s GitHub Monorepo in under three days. According to the account, the team did not directly retrieve internal source code from Monorepo but proved they had access by submitting a pull request using an employee Codex account.

The researchers say they achieved an initial foothold by exploiting a flaw in Discourse, the third-party service that runs OpenAI’s community forums. The weakness involved the system Discourse uses to process HEIF images; using that vector, Hacktron reports they obtained remote code execution on Discourse Cloud and used it to reach OpenAI’s instance. Hacktron said Claude Opus 5 launched the evening of July 24, and by 10 a.m. the following day they had leveraged it to obtain RCE on Discourse Cloud.

Hacktron describes the effort as their “HEIF Heist” project and says it was quick to adapt to multiple targets, including Slack, Meta, GitHub Enterprise, Rails, Next.js, ImageMagick and others. They report conducting the work with less than $3,000 in model tokens and say, to their knowledge, only Shopify detected the activity. The researchers disclosed the vulnerabilities to Discourse and OpenAI, and the issues have since been patched.

OpenAI reportedly paid Hacktron $6,500 for the bug. Hacktron CTO Mohan Pedhapati told the WSJ the team does not see itself on par with nation-state actors, saying, “I don’t think we are as strong as Chinese threat actors… We’re just three guys with Claude and Codex subscriptions.”