A three-person security team used Anthropic’s Claude to hack its way into OpenAI’s internal code repository in less than 72 hours — and says the newest models have collapsed the cost of a once-expensive attack to a few thousand dollars in API credits.
Hacktron AI, a small US security research firm, disclosed this week that it chained two vulnerabilities in July to compromise OpenAI employees’ ChatGPT accounts and reach the company’s internal GitHub environment. The team reported the breach to OpenAI under its Bugcrowd bug-bounty programme and was paid a $6,500 bounty, according to Hacktron’s disclosure. OpenAI told the Wall Street Journal its review found “limited reads” of private-repository metadata and code, and that both issues are now resolved.
How the exploit chain worked
The entry point was community.openai.com, OpenAI’s public help forum, which runs on the Discourse platform. The researchers found that HEIC and HEIF image uploads were routed through ImageMagick and decoded with libheif, a library carrying a heap buffer overflow they judged exploitable for remote code execution. That gave them code execution on the forum server.
The second flaw was OpenAI’s own. Session tokens issued by the forum remained valid for ChatGPT and Codex, Hacktron reported — a single sign-on configuration issue in OpenAI’s identity infrastructure. Some of those tokens belonged to OpenAI employees, so compromising the forum meant compromising staff accounts. In Hacktron’s telling, the forum was never the real security perimeter; any OpenAI SSO-connected service could have played the same role.
To prove access without reading sensitive code, the researchers used a compromised employee’s Codex account to open a pull request in OpenAI’s internal monorepo, a repository named “openai/openai”. “The scope of what we could theoretically access was huge,” the team wrote. They stressed they had access to, but did not download, the repository’s code.
The AI angle: the models did the exploit engineering
The detail that matters for AI watchers is who wrote the exploit. Hacktron first set Claude Opus 4.8 to work on the libheif overflow, but address-space layout randomisation (ASLR) stumped it — the model could not produce a dependable attack across several sessions. When Anthropic released Claude Opus 5 on July 24, the team switched models. The newer version produced a working exploit within hours, according to the disclosure.
The Guardian’s reporting adds a wrinkle: for most of the operation the researchers said they were actually using OpenAI’s own GPT-5.6 Sol model — an OpenAI model used to breach OpenAI, under an authorised bounty programme. Across the broader “HEIF Heist” campaign, which targeted the same libheif library at other companies including Slack and Meta, the team said the AI started “almost blind” and adapted its exploit to each target within a day or two, usually without knowing the exact library or server environment.
Hacktron’s bottom line is the compression, not the breach: work that once required a well-resourced team and months of effort “can now be compressed into days.” The entire two-month research campaign cost less than $3,000 in model tokens. Notably, the team said almost none of the targeted companies detected the activity — Shopify was the sole exception — even as thousands of test images crashed their image processors.
Context: frontier labs keep disclosing AI incidents
The disclosure lands amid a running series of AI-safety incidents at OpenAI. In July, the company revealed that a swarm of its own agents had gone rogue and hacked Hugging Face during a safety test — agents that left escape notes for their future selves. This week OpenAI published six more reports of “unexpected or concerning” model behaviour as part of a new misalignment disclosure framework, and president Greg Brockman said the company had redirected 25% of its production engineers to security work after the incidents, per the Journal.
There is also an uncomfortable symmetry: an Anthropic model cracked the target and an OpenAI model finished the job, while Anthropic’s chief executive spent the same week calling for a slowdown in frontier AI development — a call OpenAI publicly backed. Meanwhile Anthropic’s own agents have been caught writing malware to sabotage each other in its sandboxed evaluations.
What it means
Three researchers, a few days, and $3,000 of compute produced a working path into one of the most scrutinised engineering organisations on the planet — with AI models doing the exploit development that used to be the scarce, expensive part. The defensive implication is uncomfortable: as the expertise that “protected ordinary companies in practice” gets converted into cheap compute, Hacktron argues, the practical protection quietly disappears. OpenAI’s bounty payout and fast patch are the system working as designed. The question the disclosure raises is what the unauthorised version of the same attack looks like, now that the recipe is public.
