FULL STORY

Claude-Powered Hack of OpenAI: From Bounty to Backlash

Three researchers used Claude Opus to chain-exploit their way into OpenAI's internal codebase within 72 hours, earning a $6,500 bounty. The disclosure sparked community backlash against OpenAI's security culture before ending in reconciliation.

2026-09-18 ~ 2026-09-21 · 4 episodes · 98 posts

Episode 1 · Three Hacktron Researchers Breach OpenAI's Internal Systems Using Claude Opus 5 (2026-09-18, 59 posts)

Three independent security researchers from Hacktron AI, operating under OpenAI's bug-bounty safe harbor, used Anthropic's Claude Opus 5 to breach OpenAI's internal systems within roughly 72 hours and under $3,000 in API tokens, taking over an employee account and reaching private code before responsibly disclosing everything; OpenAI paid a $6,500 bounty and no actual damage occurred. It is a prominent public case of an LLM materially amplifying real-world offensive efficiency, and it triggered broad debate about AI companies' own security posture.

Confirmed

  • Per WSJ reporting (relayed across many posts), the three Hacktron researchers—identified by deedydas as Rahul Maini, Mohan Pedhapati and Harsh Jaiswal (handles rootxharsh, S1r1u5, iamnoooob), none from elite schools or big companies—used Claude Opus 5 to compromise an OpenAI employee's Codex/ChatGPT account, gaining the ability to read and suggest changes to OpenAI's private software cache. YuchenjUW added that the attack cost under $3,000 in tokens and that the compromised employee's Codex opened a PR in OpenAI's internal monorepo.
  • The team's write-up says that on July 25, 2026 they chained two vulnerabilities: a heap overflow in libheif—OpenAI's Discourse forum still packaged an old version fixed upstream but never flagged as a security fix, so a malicious HEIF upload achieved code execution—and an SSO/authentication flaw in the Discourse setup. Per ChrisGPT and rohanpaulai, tokens taken from the Discourse server also worked for the employee's ChatGPT and GitHub access, completing the chain.
  • Hacktron founder S1r1u5 told Joshua Saxe they took over ChatGPT/Codex accounts of OpenAI employees (and some external users), reaching Outlook, Slack and GitHub, with full repo access within 72 hours—while stressing this doesn't mean they know how to defend such a complex organization. The team noted any ChatGPT connector (Slack, GitHub, etc.) could theoretically be affected. tszzl relayed rootxharsh's "HEIF Heist" research showing the libheif issues also affect Slack, Meta, GitHub and others.
  • After reporting without reading private content, OpenAI paid a $6,500 bounty (ChrisGPT); Hacktron published a full post-mortem, "Hacking OpenAI." The Guardian, NBC and YouTuber Wes Roth covered the incident.

Unconfirmed

  • teortaxesTex and nptacek relayed Andrew Curran's claim that the attackers may have had a version of Opus 5 with relaxed cyber guardrails; this is uncorroborated. ns123abc's prediction that the incident will be used to justify licensing controls on open-weight models is opinion, and some posts cite an "Opus 4.8" version inconsistent with mainstream reporting.

Why it matters

  • Posters highlighted this as a concrete demonstration of LLM power in reconnaissance and exploit chaining; Sneha Revanur relayed WSJ's note that the trio accessed algorithmic secrets, not model weights, questioning narratives about nation-state threats.
  • Joshua Saxe argued hacking skill is being rapidly democratized and asked how many state actors have already penetrated deeper unnoticed; YuchenjUW stressed the strikingly low cost.
  • GaryMarcus relayed lawyer justanotherlaw's point that two subscriptions and two days yielded write access to OpenAI's monorepo, exposing the fragility of top AI labs' account and supply-chain security; former OpenAI policy lead Miles Brundage mocked OpenAI for "letting itself be hacked to boost IPO valuation." The "HEIF Heist" disclosures widen the supply-chain warning to platforms like Slack and Meta.

39 more related posts →

Episode 2 · Hacktron AI Chained Two Bugs to Take Over OpenAI Accounts in 72 Hours; $6,500 Bounty Sparks Outcry (2026-09-18, 19 posts)

On July 25, security team Hacktron AI (researcher S1r1u5, with members including Harsh Jaiswal) spent under 72 hours—from reading code to building the full exploit chain—taking over ChatGPT/Codex accounts of OpenAI employees and some outside users, reaching linked Outlook, Slack and GitHub services, and having Codex open a PR in the openai/openai internal monorepo as proof. All bugs were fixed, but OpenAI paid only a $6,500 bounty, igniting debate over AI giants' security investment and bug bounty levels.

Confirmed

  • Attack chain: HEIF image upload on OpenAI's Discourse forum triggered a libheif heap overflow (HEIF Heist) for remote code execution, chained with an OpenAI SSO flaw for account takeover.
  • OpenAI fixed the reported SSO flaw within about 14 hours; Discourse received the report Saturday, replied Sunday, and fixed it Monday.
  • OpenAI paid $6,500 for the SSO bug; per @ccerrato147, that bounty covered only the OpenAI-side SSO discovery, with the Discourse forum exploitation proving real impact explicitly excluded from scope.
  • Per @pstAsiatech, the team worked under OpenAI's bug bounty program and used Anthropic Claude to help generate exploit code (other posts mention GPT-5.6 involvement); details were revealed via a LiveOverflow video and a team blog on September 18.
  • The attackers were white hats who reported and helped fix the flaws (confirmed in Reddit discussion relayed by @EconomySerious). @joshuasaxe claimed the team received "six-figure bounty recognition," conflicting with the widely reported $6,500 figure.

Unconfirmed

  • Whether the attackers actually accessed model weights, source code, or private communications; OpenAI has not officially confirmed the scope of impact.

Why it matters

  • SemiAnalysis called the $6,500 bounty "absurd and offensive," noting the finder could earn more from X creator payouts; @mvpatel2000 argued this sets a bad precedent that may deter capable researchers from reporting bugs to OpenAI.
  • Researchers note a ChatGPT account with access to GitHub, Slack and email is worth orders of magnitude more than $6,500 on gray markets, making the bounty severely mismatched to the risk.
  • Reddit discussion relayed by @EconomySerious deemed the bounty clearly out of proportion for a hundred-billion-dollar company facing a potentially huge loss.
  • The incident exposes weak links in AI giants' employee account and identity chains; @jessicawruan highlighted AI agents' ability to blindly stack exploits within two days, renewing attention on AI-assisted offense and defense.

Episode 3 · Nathan Lambert: Closed-Source Models Are the True Tip of the AI Risk Iceberg (2026-09-18, 6 posts)

On September 18, AI safety researcher Nathan Lambert posted a series of comments on the incident in which OpenAI systems were compromised/jailbroken externally via Claude. His core argument: the tip of the AI risk iceberg has always been closed-source frontier models, not open-source ones. The next day, @zivravid echoed the view and added the dimension of closed systems lacking external auditability.

Confirmed

  • Lambert's three reasons: closed models are 1) easier to get started with, 2) more capable, and 3) shipped with safety guardrails that are easy to bypass; open models carry less risk on each count.
  • He also speculated that if the same attack had been carried out with an open-source model against OpenAI, it would have been devastating to the mission of openness — potentially ending the open-weights/openness movement.
  • He criticized a double standard in the industry: incidents at closed-source vendors are treated leniently, while the open side faces harsh accountability.
  • @zivravid framed two readings of the incident: the wrong lesson is "therefore open-source AI must be banned"; the right lesson is the opposite — risk is concentrated in closed systems, which hold the most capable models, the easiest access, flawed guardrails, and no external auditability at all.

Why it matters

  • Coming amid a discourse that treats open-weight models as the main risk source deserving tighter controls, Lambert uses a real breach of a closed system as counter-evidence: closed frontier models are the more realistic attack surface.
  • His critique of double standards, plus @zivravid's auditability argument, gives open-ecosystem supporters a security-based case that could shape public and regulatory perceptions of risk ranking between open and closed models.

Episode 4 · OpenAI Disclosure Saga: CISO Reportedly Sought to Sue Researcher, Later Apologized (2026-09-19, 14 posts)

Security researcher S1r1u5 (team Hacktron) verified a flaw via Codex on cloud that granted access to OpenAI's internal monorepo, claiming the ability to laterally move toward model weights, datasets and training recipes, but deliberately downloaded nothing sensitive and proved access only with a harmless PR before responsible disclosure. By his account, OpenAI's disclosure process was a nightmare requiring lawyers and journalists; the $6,500 bounty was never the issue. OpenAI's CISO (ex-Palantir) was reported to have favored suing the researcher, drawing community mockery, but per LiveOverflow has since reached out, apologized, and reconciled.

Confirmed

  • The researcher verified repo access, proved it with a harmless PR, stopped, and followed responsible disclosure (m5)
  • The researcher described OpenAI's disclosure process as extremely difficult, requiring lawyers and journalists; bounty was $6,500 (m3)
  • LiveOverflow said the CISO proactively apologized and reconciled, noting his earlier critical thread was personal opinion (m6, m8)
  • Hacktron founder S1r1u5 clarified Claude Code did not autonomously hack OpenAI; the key was human researcher rootxharsh's prior experience (m14)
  • White-hat hacker s1r1us clarified that finding a flaw doesn't mean knowing how to protect such a complex organization; OpenAI has a more experienced security team (m12)

Unconfirmed

  • Whether the CISO actually advocated suing the researcher rests mainly on reposted accounts, with no primary source
  • No formal OpenAI commitment to fix the disclosure process appears in the material

Why it matters

  • Veteran Robert Graham criticized OpenAI and Anthropic for abandoning the security community's 40-year principles of encouraging open disclosure and opposing retaliation (m2); researcher IceSolst argued OpenAI burned a rare trust-building opportunity and the CISO should be replaced (m11)
  • A methodology debate ensued: Tal BeerySec argued 0-days call for responsible disclosure, not lateral movement, calling the PR on OpenAI's GitHub repo over the line (m13); jachiam0 (ex-OpenAI red team, now Anthropic) defended responsible disclosure even beyond bounty scope, called attacks on the CISO a distortion, and noted he had already warned about Slack lateral-movement risks (m7, m9, m10)
  • Joshua Saxe mocked OpenAI's security maturity as resembling a company scaling too fast (m4), highlighting systemic tension between frontier AI labs and the external research community