FULL STORY

Claude Hacks Into OpenAI: Bounty and Backlash

Hacktron AI researchers used Claude Opus 5 to breach OpenAI systems in under 72 hours for a $6,500 bounty, sparking ongoing controversy over scope, rewards, and security risk.

2026-09-18 ~ 2026-09-20 · 4 episodes · 88 posts

Episode 1 · Researchers Use Claude Opus 5 to Breach OpenAI's Internal Systems for Bug Bounty (2026-09-18, 59 posts)

Under OpenAI's bug bounty safe harbor framework, three independent security researchers used Anthropic's Claude to break into OpenAI's internal systems in late July, reaching private code repositories and even submitting a PR — all in roughly 72 hours for under $3,000 in API tokens. The incident came to light after a Wall Street Journal report and the researchers' own post-mortem, underscoring how LLMs can dramatically amplify the efficiency of real-world attacks. OpenAI paid a $6,500 bounty, and no actual damage occurred.

Confirmed

  • According to WSJ reporting (as relayed in multiple posts), three researchers from Hacktron AI used Claude Opus (the posts mention Claude Opus 5) in late July to compromise an OpenAI employee's Codex account.
  • The entry point was a vulnerability in the Discourse system powering OpenAI's community forum: after obtaining an authentication token, the researchers confirmed the credentials also granted access to the employee's ChatGPT and GitHub (@ChrisGPT).
  • @YuchenjUW added key details: the researchers exploited an image upload vulnerability to take over the employee's account, then had the compromised employee's Codex submit a PR to OpenAI's internal monorepo; the entire attack cost under $3,000 in API tokens and took just hours.
  • @JeffLadish, citing security researcher S1r1u5: on July 25 they chained two vulnerabilities to take over the ChatGPT/Codex accounts of an OpenAI employee (and some unrelated users), gaining access to linked services such as Outlook, Slack, and GitHub, and obtained full codebase access within 72 hours.
  • The researchers followed responsible disclosure without reading private content, and OpenAI paid a $6,500 bounty (@ChrisGPT).

Unconfirmed

  • Posts differ on some breach details (e.g., whether the entry point was a Discourse vulnerability or an image upload flaw, and the number of vulnerabilities involved); these may describe different stages of the attack chain, so the full attack path awaits official or the researchers' complete post-mortem.

Why it matters

  • @ResultBackground2450 and many who shared the story note this is a public showcase of LLMs' real-world power as penetration testing/attack assistants in information gathering and exploit chain construction.
  • @GaryMarcus, relaying legal professional @justanotherlaw's view, stressed that write access to OpenAI's monorepo was achievable with just a Claude and a Codex subscription and two days of work — showing that even top AI companies' own supply chains and account security are fragile, and sparking discussion about "using Company A's model to hack Company B" and AI safety governance.

39 more related posts →

Episode 2 · Hackers Take Over OpenAI Employee Accounts in 72 Hours, $6,500 Bounty Sparks Backlash (2026-09-18, 18 posts)

On July 25, security team S1r1u5 (also known as Hacktron AI, members include Harsh Jaiswal and others) used two vulnerability chains to take over ChatGPT/Codex accounts of OpenAI employees and some external users in under 72 hours, further reaching connected internal services like Outlook, Slack, and GitHub, and even submitted a PR to an internal code repository to prove the breach. On September 18 the team published a blog post with the details, and the incident sparked wide discussion about OpenAI's security investment and bounty levels.

Confirmed

  • Attack chain: the HEIF image upload feature on OpenAI's forum (Discourse) triggered a libheif heap overflow, combined with an OpenAI SSO flaw to achieve account takeover
  • OpenAI fixed the SSO vulnerability within about 14 hours of receiving the report; the Discourse vulnerability was reported Saturday, answered Sunday, and fixed Monday
  • OpenAI paid a $6,500 bounty for the SSO vulnerability
  • The $6,500 only covered the discovery of the OpenAI-side SSO flaw; the Discourse forum hands-on work that demonstrated real-world impact was subsequently clarified by OpenAI as "explicitly excluded" from the bounty scope

Unconfirmed

  • Whether the attackers actually accessed model weights, source code, or private communications; OpenAI has not officially confirmed the actual scope of impact in the available material

Why it matters

  • @ccerrato147 relayed researchers' view that a ChatGPT account with access to a company's GitHub, Slack, and email is worth several orders of magnitude more than $6,500 on the gray market, potentially yielding model weights, source code, and private communications—the bounty is severely mismatched with the risk
  • Researchers also criticized OpenAI for still not taking cybersecurity seriously enough after the incident was exposed; the event laid bare AI giants' weak points in employee accounts and identity authentication chains, serving as a warning for industry security practices

Episode 3 · OpenAI Breach via Claude Sparks Debate: Closed-Source Models Are the Real Risk (2026-09-18, 6 posts)

On September 18, AI safety researcher Nathan Lambert posted a series of comments on the security incident in which an external party broke into/jailbroke OpenAI systems via Claude. His core argument: the "tip of the iceberg" of AI risk has always been closed-source frontier models, not the open-source models the industry tends to worry about.

Confirmed

  • Lambert gave three reasons: closed models 1) are easier to get started with, 2) are more capable, and 3) come with safety guardrails that are easy to bypass; open models pose less risk on all of these fronts.
  • He also offered a thought experiment: if the same attack had been carried out against OpenAI using an open-source model, the "open" mission would suffer a devastating blow, and the open-weights/openness movement might even end then and there.
  • He criticized the AI industry's double standard on safety: incidents at closed-source vendors tend to be treated leniently, while any incident on the open-source side draws harsh blame (as relayed in his posts).

Why it matters

  • The statement comes amid a climate where "open-weights models" are often framed as the main risk source and calls for tighter control are common. Using a real breach of a closed system, Lambert argues the reverse: closed frontier models — more capable, easier to access, with bypassable guardrails — are the more realistic attack surface.
  • His critique of the double standard, together with the hypothetical that an equivalent attack on an open model would end the openness movement, gives open-ecosystem supporters a safety-based argument and could shift how the public and regulators rank open vs. closed model risks.

Note: this cluster of five posts is the same author repeatedly restating the same event with highly overlapping information; they have been merged above.

Episode 4 · OpenAI repo access row spirals as security community turns on its CISO (2026-09-19, 5 posts)

The Hacktron team disclosed that it had gained access to OpenAI's internal monorepo, claiming it "had the conditions for lateral movement to obtain model weights, datasets, and training recipes." The ensuing controversy keeps escalating in the security community, with OpenAI's security maturity and crisis communications both under fire. TL;DR: The core facts are that Hacktron did access OpenAI's internal repository and claims it was positioned to move laterally for further assets; external criticism has centered on OpenAI's insufficient security maturity and the CISO's mishandling, while former OpenAI safety researcher jachiam0 publicly pushed back, accusing critics of distorting the facts—the dispute has evolved from a technical issue into a trust crisis between the security community and OpenAI.

Confirmed

  • Hacktron previously disclosed that it had entered OpenAI's internal repository and claimed the capability for lateral movement to obtain model weights, datasets, and training recipes.
  • Joshua Saxe criticized OpenAI's security maturity on this basis, comparing it to a company growing recklessly.
  • Prominent security researcher LiveOverflow posted a tweet thread analyzing, from a personal perspective, the OpenAI CISO's PR and handling missteps in this security incident, concluding the response was botched.
  • Security researcher IceSolst posted criticism of OpenAI for not engaging with the security community: a group of hackers with the skills and interest to report vulnerability chains came forward—an ideal opportunity to build trust—yet OpenAI's poor reaction squandered it; he argued the CISO should be replaced over this.

Unconfirmed

  • The specific allegations of the CISO's missteps in LiveOverflow's thread were not detailed in the source material; see the original thread.

Why it matters

  • The controversy has moved beyond a single vulnerability incident into a reckoning over AI labs' security governance and their relationship with the outside community: jachiam0 noted that all major AI labs rely on Slack, and scenarios where employees routinely move laterally through it are widespread—an ecosystem-level risk.
  • In responding to Joshua Saxe, jachiam0 stressed that he explicitly supports open, clear-eyed discussion of the cybersecurity risks labs face, citing an older post where he had already warned about Slack lateral-movement risks (a post Saxe once liked)—showing that critics themselves are not aligned, and that public portrayals of the incident risk being oversimplified or distorted.