Claude Hack OpenAI: How Researchers Broke Into OpenAI’s Systems

By Muhammad Ramzan Aatish

The pull request was numbered 1186742. It changed nothing important, a harmless edit inside one of OpenAI’s private repositories, and that was precisely the point. Its authors were three security researchers who had reached that repository through a chain of flaws they were never meant to find, using exploit code written by Anthropic’s Claude. The whole operation, run inside OpenAI’s own bug-bounty program, took under three days. That compressed timeline is what makes the Claude hack OpenAI story matter: work that once demanded a specialized offensive-security team and months of runway now fits into a long weekend.

The Claude hack OpenAI break-in, hour by hour

The team behind the Claude hack OpenAI operation was Hacktron AI, a three-person security startup led by chief technology officer Mohan Pedhapati, with researchers Harsh Jaiswal and Rahul Maini. The Wall Street Journal broke the story after interviewing the team; Hacktron later published its own full technical write-up.

Day one. The researchers traced the image-upload path on community.openai.com, OpenAI’s Discourse-powered help forum, through ImageMagick down to the libheif library, and found a heap buffer over-read buried inside it.

Day two. Hacktron fed the bug to a cybersecurity build of Claude Opus 4.8. Across several sessions it struggled: it could build a working exploit only with ASLR, the memory-randomization defense that makes real-world attacks unreliable, switched off. Then Anthropic released Claude Opus 5 that evening. Within hours, the same problem was solved properly.

Day three, before sunrise. With Opus 5, the team had reliable remote code execution through a simple image upload, ASLR on. By mid-morning, the exploit had been turned against OpenAI’s live forum and confirmed working. Early afternoon, using the second flaw in the chain, they took over employee ChatGPT and Codex accounts and opened the proof-of-access pull request, then stopped testing entirely. That same afternoon, the initial report went to OpenAI through its Bugcrowd program; roughly fourteen hours later, the fix was confirmed and the affected tokens were revoked.

Both sides moved fast after that. Discourse received the report through HackerOne the next day, had a fix ready within two days, adding image-processing sandboxing as extra defense, and published its security advisory the following week. About five weeks later, OpenAI paid Hacktron a $6,500 bounty and marked the case resolved.

A heap overflow hiding in a photo upload

The front door of the Claude hack OpenAI operation was almost embarrassingly ordinary. OpenAI’s forum accepted HEIF and HEIC photos, the format iPhones save pictures in by default. Uploading one sent it through a conversion chain that ended at libheif, the open-source library that decodes those files. The exploit chain, as Hacktron documented it, ran like this:

The underlying bug is tracked as CVE-2026-32882, a heap buffer over-read in HeifPixelImage::overlay(), where a crafted file could force reads thousands of bytes past the buffer. It was patched upstream months before the attack. Here is what deserves a pause: the CVE existed, the fix existed, and the vulnerable version was still running in production. Hacktron’s own chain diagram marks the gap plainly, the Debian security backport never arrived. A tracking number is not the same thing as a patched system.

The login tokens that trusted too much

Once inside the forum server, the researchers found a flaw that was entirely OpenAI’s own. The community forum’s sign-in tokens carried permissions far beyond the forum, and those tokens worked on ChatGPT itself. Some belonged to OpenAI employees.

From there the chain was short. An employee’s ChatGPT account led to their Codex account, which was connected to OpenAI’s GitHub organization. Through it, the team opened PR #1186742 in the internal monorepo, the repository the Journal described as holding OpenAI’s algorithmic secrets. OpenAI says the repository did not include model weights, and its review found only limited reads of private repository metadata and commits. The researchers say they deliberately read nothing and downloaded nothing. Hacktron also noted that employee Slack and emails could theoretically have been reached through connected accounts; OpenAI says that access was never verified.

The striking part is that this flaw was an architecture choice, not a subtle coding error. Until roughly two months before the story broke, anyone logging into OpenAI’s own help forum, employee or not, could potentially have had their ChatGPT and Codex accounts taken over. OpenAI has been publishing its own misalignment disclosures alongside this era of incidents; this site’s breakdown of six recent misalignment cases reads as useful context for the climate these discoveries landed in.

Opus 5 did the exploit math; the humans aimed it

Finding the bug was the human part. Building the working exploit used in the Claude hack OpenAI operation was Claude’s, but the full picture is less tidy than either claim alone.

Reading through Hacktron’s own write-up, the detail I kept coming back to was the proxy. Opus had refused to write an exploit for a real remote target, so the team pointed it at their own Discourse instance and disguised it as a practice target, routed through an address that made it look like a CTF. The model took the bait and built the working exploit anyway. That tells you two things at once: the refusal logic is real, and it is brittle.

And the team is explicit that the work was not hands-off. Claude needed skilled direction at every stage, porting the exploit from an ARM64 build on a local Mac to the x86-64 production architecture, defeating ASLR, adapting the technique. Opus 4.8 failed that jump; Opus 5 cleared it overnight. The honest reading is uncomfortable for both camps: the model collapsed the hardest technical bottleneck, exploit development against modern memory protections, while the humans supplied everything the model couldn’t do alone. That split, machine-built exploit and human-run operation, is the part of the Claude hack OpenAI story most retellings flatten. Pedhapati’s summary to the Journal was blunter: “We’re just three guys with Claude and Codex subscriptions.” Gray Swan CEO Matt Fredrikson put the industry implication to TechCrunch: “For $200 a month, anyone can use these tools and hack into a company like OpenAI. If it can happen to them, and I don’t think they’ve been slouching recently on cybersecurity hygiene, it could happen to anyone.”

What the $6,500 bounty actually covered

The $6,500 payout has become one of the most misread parts of the Claude hack OpenAI story, so here is what Hacktron’s write-up says plainly:

• The award was $6,500, paid about five weeks after the operation. It recognized the OpenAI-side finding, the SSO misconfiguration, not the Discourse forum work, which OpenAI stated was explicitly outside its bounty program’s scope.
• The forum-side reporting went elsewhere. The libheif flaw and its Discourse impact were reported to Discourse through HackerOne, which shipped the fix and sandboxing within two days.
• Scope boundaries matter. A bug-bounty program is not a blanket permission slip; OpenAI had to clarify after the fact that testing the third-party forum was never covered by its program. If you run a bounty program, write that sentence before you need it.

Three checks worth running on your own systems

The value of the Claude hack OpenAI story isn’t the drama. It’s the three concrete things it suggests doing, all traceable to what the incident actually showed:

Why it still matters

The wider campaign makes the single incident harder to dismiss. Hacktron calls the broader effort “HEIF Heist”, a multi-month investigation that traced the same libheif weakness across Slack, Meta, GitHub Enterprise, Ruby on Rails, and Node.js frameworks like Next.js and Astro, with total AI token spend under $3,000. OpenAI was one target among many. A surprising share of the modern web, it turns out, leans on the same one image library.

Watching the story spread, one reaction stuck with me more than the hot takes. Deedy Das Purkayastha, the engineer behind one of tech’s most-read X accounts, posted the three researchers’ profiles with a short note: “No brand name colleges or companies. Just raw curiosity and skill. You can just do things.” That was the admiration strand of the reaction, and it explains why the Claude hack OpenAI story traveled so far. It wasn’t only a breach; it was a demonstration that three people with two subscriptions could do what used to take an offensive team. For broader context on how capable today’s AI assistants have become, this site’s overview of Meta’s Muse AI walks through one of the leading personal agents.

The pattern to watch is simple enough to state. Each model generation quietly resets what “capable” means, Opus 4.8 couldn’t cross the line, Opus 5 did it overnight, while the supply chain underneath keeps running fixed-but-unpatched libraries. That combination is the real lesson of the Claude hack OpenAI episode, and it didn’t get patched with the bug.

FAQ