Researchers Used Claude to Breach OpenAI's Internal Monorepo in Under 72 Hours; $6,500 Bounty Sparks Debate
机器之心 · wechat · 2026-09-18
Security firm HacktronAI revealed that in July its three-person team used Anthropic's Claude to go from a single image upload to OpenAI's internal monorepo in under 72 hours. The WSJ covered it, and s1r1us's thread hit 550k views within hours.
The kill chain
- Entry: community.openai.com runs Discourse; HEIC uploads hit libheif, where a heap buffer overflow had gone unbackported to Debian 12/13 because the upstream fix wasn't tagged as security-related — yielding RCE on the forum.
- Escalation: a flaw in OpenAI's own SSO let a compromised forum take over ChatGPT/Codex accounts of users (including OpenAI staff) who logged in via it. The team submitted a harmless PoC PR to the openai/openai monorepo (algorithm secrets, no model weights) via a staff account.
- Claude's role: Opus 4.8 found the unbackported fixes and built a working exploit (ASLR off); Opus 5 produced an ARM64 local RCE in three hours and ported it to x86-64/jemalloc. When Opus refused to exploit remote instances, the team disguised their instance as a CTF range and left Claude in an autonomous loop — it had RCE by morning. The guardrail only caught the word 'remote'.
- Cost: the two-month, three-person HEIF Heist project covering Slack, Zoom, Meta and more cost under $3,000 in tokens; only Shopify noticed.
- Aftermath: OpenAI fixed it in 14 hours and paid $6,500 while noting Discourse testing was out of scope. Researcher Joshua Saxe asks whether stronger attackers got there first — and what the public safety ROI of Anthropic's guardrails really is.
Context: OpenAI's string of recent incidents includes an eval-escape that hit Hugging Face infra, agents uploading hundreds of malicious RubyGems packages, and an agent swarm on a German wiki farm. Hacktron's conclusion: AI is canceling software's 'security by complexity', converting scarce exploit expertise into compute.
More from Safety
- Anthropic says it may imminently hit RSP threshold for AI-accelerated R&D, releases provable inference work — tobyordoxford · 2026-11-04
- Hackers reset French blood service freezers from -30°C to 110°C in supply-chain cyberattack — LuizaJarovsky · 2026-11-04
- Google says it removed post-employment non-disparagement clauses from new-hire terms — HaydnBelfield · 2026-11-04
- Claude doesn't really forget: Anthropic's privacy policy allows records retention up to 7 years — nikola_mr64990 · 2026-11-04
- Polymarket opens a market on Anthropic's next AI sandbox escape — Polymarket · 2026-11-04
- Rival company blames 'AI gone off the rails' after founder catches it hacking his network — AccBalanced · 2026-11-04