Three Hacktron Researchers Breach OpenAI's Internal Systems Using Claude Opus 5
Three independent security researchers from Hacktron AI, operating under OpenAI's bug-bounty safe harbor, used Anthropic's Claude Opus 5 to breach OpenAI's internal systems within roughly 72 hours and under $3,000 in API tokens, taking over an employee account and reaching private code before responsibly disclosing everything; OpenAI paid a $6,500 bounty and no actual damage occurred. It is a prominent public case of an LLM materially amplifying real-world offensive efficiency, and it triggered broad debate about AI companies' own security posture.
Confirmed
- Per WSJ reporting (relayed across many posts), the three Hacktron researchers—identified by deedydas as Rahul Maini, Mohan Pedhapati and Harsh Jaiswal (handles rootxharsh, S1r1u5, iamnoooob), none from elite schools or big companies—used Claude Opus 5 to compromise an OpenAI employee's Codex/ChatGPT account, gaining the ability to read and suggest changes to OpenAI's private software cache. YuchenjUW added that the attack cost under $3,000 in tokens and that the compromised employee's Codex opened a PR in OpenAI's internal monorepo.
- The team's write-up says that on July 25, 2026 they chained two vulnerabilities: a heap overflow in libheif—OpenAI's Discourse forum still packaged an old version fixed upstream but never flagged as a security fix, so a malicious HEIF upload achieved code execution—and an SSO/authentication flaw in the Discourse setup. Per ChrisGPT and rohanpaulai, tokens taken from the Discourse server also worked for the employee's ChatGPT and GitHub access, completing the chain.
- Hacktron founder S1r1u5 told Joshua Saxe they took over ChatGPT/Codex accounts of OpenAI employees (and some external users), reaching Outlook, Slack and GitHub, with full repo access within 72 hours—while stressing this doesn't mean they know how to defend such a complex organization. The team noted any ChatGPT connector (Slack, GitHub, etc.) could theoretically be affected. tszzl relayed rootxharsh's "HEIF Heist" research showing the libheif issues also affect Slack, Meta, GitHub and others.
- After reporting without reading private content, OpenAI paid a $6,500 bounty (ChrisGPT); Hacktron published a full post-mortem, "Hacking OpenAI." The Guardian, NBC and YouTuber Wes Roth covered the incident.
Unconfirmed
- teortaxesTex and nptacek relayed Andrew Curran's claim that the attackers may have had a version of Opus 5 with relaxed cyber guardrails; this is uncorroborated. ns123abc's prediction that the incident will be used to justify licensing controls on open-weight models is opinion, and some posts cite an "Opus 4.8" version inconsistent with mainstream reporting.
Why it matters
- Posters highlighted this as a concrete demonstration of LLM power in reconnaissance and exploit chaining; Sneha Revanur relayed WSJ's note that the trio accessed algorithmic secrets, not model weights, questioning narratives about nation-state threats.
- Joshua Saxe argued hacking skill is being rapidly democratized and asked how many state actors have already penetrated deeper unnoticed; YuchenjUW stressed the strikingly low cost.
- GaryMarcus relayed lawyer justanotherlaw's point that two subscriptions and two days yielded write access to OpenAI's monorepo, exposing the fragility of top AI labs' account and supply-chain security; former OpenAI policy lead Miles Brundage mocked OpenAI for "letting itself be hacked to boost IPO valuation." The "HEIF Heist" disclosures widen the supply-chain warning to platforms like Slack and Meta.
2026-09-18 ~ 2026-09-19 · 59 related posts
- Episode 1: Three Hacktron Researchers Breach OpenAI's Internal Systems Using Claude Opus 5(2026-09-18, 59 posts)
- Episode 2: Hacktron AI Chained Two Bugs to Take Over OpenAI Accounts in 72 Hours; $6,500 Bounty Sparks Outcry(2026-09-18, 19 posts)
- Episode 3: Nathan Lambert: Closed-Source Models Are the True Tip of the AI Risk Iceberg(2026-09-18, 6 posts)
- Episode 4: OpenAI Disclosure Saga: CISO Reportedly Sought to Sue Researcher, Later Apologized(2026-09-19, 14 posts)
Primary sources
- Three guys with Claude and Codex subscriptions reportedly gained write access to OpenAI's monorepo in two days — GaryMarcus · 2026-09-18
- [source] Researchers Reached OpenAI's Private Monorepo via Discourse Forum Bug, Earned $6,500 Bounty — ChrisGPT · 2026-09-18
- Security Team Used Anthropic's Claude to Breach an OpenAI Employee's ChatGPT Account, Reaching Private Code — EthanJPerez · 2026-09-18
- Report: Hackers Used a Loosened-Guardrail Opus 5 to Breach OpenAI's Internal Monorepo — teortaxesTex · 2026-09-18
- Security veteran on WSJ's Hacktron breach of OpenAI's monorepo: elite hacking is being rapidly democratized — joshua_saxe · 2026-09-18
- [source] Independent Researchers Used Claude to Break Into OpenAI — Full Writeup — ResultBackground2450 · 2026-09-18
- Report: Three Researchers Used Claude Opus 5 to Breach an OpenAI Employee's Codex Account — EthanJPerez · 2026-09-18
- Two bugs let hackers hijack OpenAI employee accounts in 72 hours, reaching monorepo — JeffLadish · 2026-09-18
- [source] Under $3,000 in Tokens: Claude Opus 5 Cracked OpenAI's Internal Repo in Hours — Yuchenj_UW · 2026-09-18
- WSJ: Three 'Guys With Claude and Codex Subscriptions' Hacked Into OpenAI's Monorepo — GarrisonLovely · 2026-09-18
- Three Hackers Took Over OpenAI Employee Accounts in 72 Hours, Sparking AI Race Backlash — trevposts · 2026-09-18
- Researchers say they compromised multiple OpenAI employees' ChatGPT accounts — ChengleiSi · 2026-09-18
- WSJ: Three Attackers Plus Claude and Codex Stole OpenAI's Algorithmic Secrets, Not Weights — trevposts · 2026-09-18
- Researchers Used Loosened-Guardrail Opus 5 to Access OpenAI's Internal Monorepo — nptacek · 2026-09-18
- Three researchers with Claude and Codex gained write access to OpenAI's monorepo in two days — andersonbcdefg · 2026-09-18
- Miles Brundage mocks OpenAI: 'obviously let themselves get hacked to boost IPO valuation' — Miles_Brundage · 2026-09-18
- Security researchers reportedly used Claude to break into an OpenAI employee's ChatGPT account — Polymarket · 2026-09-18
- Security Team Used Claude to Breach OpenAI Employee Account, WSJ Reveals — ChengleiSi · 2026-09-18
- Hackers chained a heap overflow and SSO flaw to breach OpenAI internal repos in 72 hours — robleclerc · 2026-09-18
- HEIF Heist: one image parser bug class hits OpenAI, Slack, Meta, GitHub Enterprise with RCE — Miles_Brundage · 2026-09-18
- Researchers used Claude Opus 5 to chain a Discourse flaw into OpenAI's private code — rohanpaul_ai · 2026-09-18
- Hackers say same image parser bug that hit OpenAI also affects Slack, GitHub, Meta — Miles_Brundage · 2026-09-18
- Chained Forum RCE and SSO Flaw Let Researcher Reach OpenAI's Internal GitHub Repo — paul_cal · 2026-09-18
- Commenter: Opus-orchestrated OpenAI hack could become the excuse to license open-weight models — ns123abc · 2026-09-18
- Meet the 3 Indian engineers who hacked OpenAI with Opus 5 in 2 days for under $3,000 — deedydas · 2026-09-18
- Researchers Used Claude to Breach OpenAI's Internal Monorepo in Under 72 Hours; $6,500 Bounty Sparks Debate — 机器之心 · 2026-09-18
- Cyber researchers reportedly used Opus 5 to hack into OpenAI — kimmonismus · 2026-09-18
- HEIF image exploit chains into OpenAI internal GitHub via Discourse forum bug — jedisct1 · 2026-09-18
- Hacking OpenAI: a writeup on attacking OpenAI's security — boppinmule · 2026-09-18
- Researchers ethically hacked OpenAI using Anthropic's Claude, accessed internal caches — nordicinst · 2026-09-18
- Researchers spent under $3,000 in AI tokens to hack into an OpenAI employee's ChatGPT account — TechNadu · 2026-09-18
- How a libheif RCE and SSO flaw chained from image upload to OpenAI internal access — TechNadu · 2026-09-18
- Anthropic's Claude Reportedly Used to Hack OpenAI — Loo_Atreides · 2026-09-18
- OpenAI 'ethically hacked' with help of Anthropic's Claude chatbot — itsxzy · 2026-09-18
- libheif heap overflow and SSO misconfiguration expose OpenAI employee accounts — ccerrato147 · 2026-09-18
- OpenAI's single SSO spans forum to GitHub and Slack: crack one service, get everything — ccerrato147 · 2026-09-18
- Thousands of malicious images crashed OpenAI's image processors and nobody noticed — ccerrato147 · 2026-09-18
- From public image upload to PR inside OpenAI's internal monorepo in under 72 hours — ccerrato147 · 2026-09-18
12 near-duplicate retellings: Miles_Brundage · rohanpaul_ai · dotey · tszzl · deedydas · jedisct1 · eli_lifland · 量子位 · Expert_Annual_19 · JacquesThibs · itsxzy · ccerrato147