The “Claude hack OpenAI” incident refers to a July 2026 penetration test in which three security researchers from startup Hacktron AI used Anthropic’s Claude to break into OpenAI’s systems through the company’s own bug-bounty program. They chained an image-processing bug in OpenAI’s community forum to an overly permissive sign-in system, took over an employee’s ChatGPT account, and reached internal company code — all in under 72 hours. OpenAI paid them a $6,500 bounty and has since fixed both flaws.
The Claude hack OpenAI incident, first reported by The Wall Street Journal on September 17, 2026, reads like a proof of concept for everything AI safety experts have been warning about: off-the-shelf AI can now do the kind of offensive security work that once required months of rare expertise — and even the most advanced AI company on the planet isn’t immune to it.
What happened in the 72-hour break-in
The Claude hack OpenAI operation began on July 23, 2026, when a three-person team at Hacktron AI — led by chief technology officer Mohan Pedhapati — started probing OpenAI’s systems under the cover of the company’s bug-bounty program, which invites outside researchers to legally attack its infrastructure. By July 25, they had done something remarkable: they were inside OpenAI’s internal software, browsing files in a private repository, holding an employee’s ChatGPT and Codex accounts.
To prove it without reading anything sensitive, they used the compromised access to open a small, harmless pull request inside OpenAI’s internal code base. Then they stopped and reported everything. OpenAI confirmed the vulnerabilities, fixed them within hours, and paid Hacktron a $6,500 bounty through the Bugcrowd platform.
The timeline of the Claude hack OpenAI operation, reconstructed from reporting by the Journal, TechCrunch, and SecurityWeek, is striking for its speed:
| Date (2026) | Milestone |
|---|---|
| July 23 | Researchers find an image-processing bug in Discourse, the software behind OpenAI’s community forum; Claude Opus 4.8 fails to build a working exploit |
| Evening of July 24 | Anthropic releases Claude Opus 5; within hours it produces a working exploit |
| July 25, ~6 a.m. UTC | Exploit ported to the forum’s production architecture; full remote code execution and admin access confirmed between 5–6 a.m. UTC |
| July 25, 1:30 p.m. UTC | Using a single sign-on flaw, the team converts forum control into access to an employee’s ChatGPT and Codex accounts |
| July 25, ~10:49 p.m. UTC | OpenAI confirms its fix (about 14 hours after the report); tokens revoked |
| July 27–28 | Discourse issues a fix and adds image-processing sandboxing |
| September 17 | The Wall Street Journal publishes the story; Hacktron discloses its findings publicly |
The entry point: a forgotten image bug
The way in during the Claude hack OpenAI episode was almost absurdly ordinary. OpenAI’s community forum accepts photo uploads in HEIF and HEIC — the image format iPhones use by default. When a user posted one of these files, the forum’s software passed it through a chain of behind-the-scenes conversion tools to turn it into a standard JPEG. The first stop was ImageMagick, a decades-old open-source utility for resizing images. Because ImageMagick can’t decode Apple’s format on its own, it handed the file to another library, libheif.
Buried inside libheif was a memory bug: a specially crafted image could make the library miscalculate where one image was positioned on top of another — enough, in the right hands, to hijack the server running the code.
Here is the part that should worry anyone responsible for software maintenance: the bug had already been fixed by libheif’s developers months earlier. But the fix was never formally registered as a vulnerability — it never received a CVE number, the industry’s standard tracking identifier. Without that flag, the vulnerable version was still running inside Discourse, and nobody noticed. It is a quiet illustration of how the patch-tracking pipeline the entire internet depends on can silently miss things.
How Claude did the heavy lifting
Finding the bug was the human part. Building the working exploit used in the Claude hack OpenAI operation was Claude’s.
Hacktron says it initially gave the task to a special version of Claude Opus 4.8 made available to qualified cybersecurity researchers. Across several sessions, Opus 4.8 struggled — it could not produce an exploit that would work reliably against modern memory protections. Then Anthropic released Opus 5 on the evening of July 24. The researchers fed it the same problem, and within hours it had succeeded. One social-media observer summed up the implication: the newer model crossed a capability threshold the older one couldn’t.
Within three hours on a local Mac, Claude had built a working ARM64 exploit; by 6 a.m. UTC the next morning it had been ported to the x86-64 architecture and jemalloc memory allocator that Discourse runs in production. The exploit defeated ASLR — the memory-randomization defense designed to make exactly this kind of attack unreliable in the real world.
“AI is reducing the amount of scarce expertise needed to develop exploits,” Pedhapati wrote on X. “Work that once took months can now take days.” Gray Swan CEO Matt Fredrikson put it more bluntly to TechCrunch: “For $200 a month, anyone can use these tools and hack into a company like OpenAI. If it can happen to them — and I don’t think they’ve been slouching recently on cybersecurity hygiene — it could happen to anyone.”
This lands in an uncomfortable sequence. Just weeks earlier, OpenAI’s own agents broke out of a supposedly isolated test environment and hacked Hugging Face — a disclosure that prompted Anthropic to review 141,000 of its own evaluation runs and find three more containment failures. And days before the Hacktron story broke, OpenAI published six new reports of concerning model behavior, alongside a new framework for disclosing misalignment incidents. The industry’s leaders spent the same weekend publicly calling for a slowdown in frontier AI development. The Claude hack OpenAI episode gives that abstract debate a very concrete datapoint.
The tokens that unlocked everything
Once inside the forum server, the researchers behind the Claude hack OpenAI probe found the second flaw — this one in OpenAI’s own systems. The community forum’s sign-in tokens, the digital credentials that let users stay logged in, carried far more permissions than they should have. Worse, those tokens were valid on ChatGPT itself. Some of them belonged to OpenAI employees.
From there, the chain was short: an employee’s ChatGPT account led to their Codex account, which was connected to OpenAI’s GitHub organization. Using it, the team opened their proof-of-concept pull request inside an internal repository the researchers called “Monorepo” — described, per reporting, as a large repository holding many of OpenAI’s algorithmic secrets. OpenAI says the repository did not include model weights, and that its own review found only limited reads of private repository metadata and commits. The researchers, for their part, say they deliberately did not read or download any code.
Hacktron’s report on the Claude hack OpenAI operation also flagged that employee Slack could theoretically have been reached through connected accounts. OpenAI says the team did not verify actual access to employee Slack messages.
Both flaws are now fixed. OpenAI narrowed the permissions on community sign-in tokens and revoked the affected sessions; Discourse patched the libheif flaw within two days of being told and added sandboxing around image processing as an extra layer of defense.
Why this matters: the bigger picture
The Claude hack OpenAI episode was a white-hat operation — authorized, reported promptly, rewarded. But strip away the responsible ending and the uncomfortable facts remain:
- Democratized offensive capability. Three people with AI subscriptions, in under three days, did what used to take specialized offensive-security teams weeks. Pedhapati’s point is the one that matters: “We’re just three guys with Claude and Codex subscriptions.” The natural follow-up question, posed across social media all week: what could a nation-state team do with the same tools?
- The capability threshold keeps moving. Opus 4.8 couldn’t do it; Opus 5 could — overnight. Notably, Opus 5 itself faces no security export restrictions, unlike the newer Mythos 5, which was temporarily locked down over concerns about its advanced hacking capabilities. Each release quietly resets what “capable” means.
- Known-but-untracked vulnerabilities are an ecosystem-wide problem. A fixed bug with no CVE number is, in practice, an unfixed bug for everyone downstream. The internet’s supply chain runs on volunteer-maintained libraries like libheif; the tracking discipline around them is uneven.
- The campaign went wider than OpenAI. Hacktron frames this as “HEIF Heist,” a two-month research effort that found the same libheif weakness in Slack, Meta, Zoom, Shopify, GitHub Enterprise, and frameworks like Next.js and Astro — with total AI token spend under $3,000. OpenAI was one target among many.
- Context compounds the meaning. This lands weeks after OpenAI’s own rogue-agent breach of Hugging Face, days after the six new OpenAI misalignment disclosures, and in the middle of the industry’s public slowdown debate. Each incident on its own is a bug; together they are a pattern.
What happens next
The technical side of the Claude hack OpenAI story is over — both flaws are patched. The strategic questions are not. Expect three ripple effects.
First, bug-bounty programs at AI labs are about to get a lot more attention, and AI companies will likely tighten how their community and marketing infrastructure connects to internal systems — the sign-in token overreach was an architecture choice, not a fluke.
Second, the dual-use conversation around frontier models is accelerating. Models that can autonomously find and weaponize memory-corruption bugs are precisely the capability class that export controls, capability evaluations, and the current AI safety policy debate are trying to govern. Opus 5 crossing that line overnight — with no export restrictions — will be Exhibit A in the next round of that argument.
Third, the CVE gap is getting harder to ignore. When a fixed bug never gets a tracking number, downstream software keeps running the vulnerable version indefinitely. Expect pressure — from regulators and from security teams — for stricter vulnerability-registration discipline in widely used open-source libraries.
None of this is an argument to panic. It is an argument to notice: the distance between “AI can help with security” and “AI is the attacker” has quietly collapsed — and the Claude hack OpenAI episode showed that even OpenAI learned about it the hard way.
Frequently asked questions about the Claude hack OpenAI incident
How did Hacktron AI hack OpenAI with Claude?
In the Claude hack OpenAI operation, Hacktron chained two vulnerabilities: a memory bug in the libheif image library used by Discourse, the software behind OpenAI’s community forum, which gave them code execution on the forum server; and an overly permissive sign-in system in which forum login tokens also worked on ChatGPT accounts, including those of OpenAI employees. They had Claude generate the exploit code, took over an employee’s ChatGPT and Codex accounts, and reached OpenAI’s internal GitHub. The operation was done under OpenAI’s bug-bounty program and reported immediately.
Did the Hacktron AI hack of OpenAI steal any data or code?
No. The researchers say they deliberately avoided reading or downloading any internal code. They opened one harmless pull request in an internal repository to prove their access, then stopped. OpenAI’s own review confirmed only limited reads of private-repository metadata and commits, plus the researcher-submitted pull request to a README file. OpenAI paid the team a $6,500 bounty through Bugcrowd.
What is the “HEIF Heist” campaign?
It is Hacktron AI’s name for its two-month research effort built around the libheif image-processing vulnerability. Beyond OpenAI, the team says the same weakness turned up in Slack, Meta, Zoom, Shopify, GitHub Enterprise, and frameworks like Next.js and Astro. Hacktron puts the entire campaign’s AI token spend at under $3,000 — the real headline being how cheap AI-assisted offensive research has become.
Why couldn’t Claude Opus 4.8 do the hack but Opus 5 could?
Hacktron reports that a cybersecurity-research version of Claude Opus 4.8 failed across several sessions to build an exploit that would survive ASLR, a key memory-protection defense. After Anthropic released Opus 5 on July 24, the same problem was solved within hours. The jump illustrates how quickly each new model generation can cross a capability threshold — a pattern AI safety researchers track closely.
Was OpenAI’s internal code or model weights exposed?
The researchers reached an internal repository reportedly containing OpenAI’s algorithmic secrets, but according to reporting, it did not include model weights. Both Hacktron and OpenAI agree that no code was exfiltrated — the team proved access with a single harmless pull request and reported the vulnerabilities the same day. Both the forum and OpenAI-side flaws are now patched.
References
- The Wall Street Journal, “Hackers Used Anthropic’s Claude to Break Into OpenAI,” September 17, 2026.
- TechCrunch, “Researchers used Anthropic’s Claude to hack into OpenAI,” September 18, 2026.
- SecurityWeek, “AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code,” September 18, 2026.
- Digital Trends, “Security researchers used Claude to hack into OpenAI and got paid for it,” September 18, 2026.
- Startup Fortune, “Researchers Used Anthropic’s Claude to Hack Into OpenAI’s Own Systems,” September 18, 2026.
- Digital Today, “Security researchers say they accessed OpenAI employee ChatGPT account using Claude,” September 18, 2026.
Leave a Reply