Hacktron researchers breached OpenAI using Anthropic’s Claude in 72 hours

A breach of OpenAI’s internal systems by three security researchers using Anthropic’s Claude demonstrates how AI can compress exploit-development timelines from months to days. The incident underscores both the accelerating pace of AI-assisted attacks and the concentration of security risk around widely-deployed AI coding tools.

• Three Hacktron researchers breached OpenAI accounts and accessed an internal code repository in under 72 hours using Claude.
• Anthropic’s Claude Opus 5, released July 24, succeeded where its predecessor Opus 4.8 failed at developing a reliable exploit against ASLR-protected systems.
• The researchers gained access through a chain of vulnerabilities: an image-processing flaw in Discourse, OpenAI’s identity infrastructure weakness, and an employee’s GitHub connection to internal repositories.

• 72 hours Time from initial attack to access of OpenAI’s internal code repository
• July 24 Release date of Claude Opus 5, enabling exploit breakthrough after Opus 4.8 stalled
• $6,500 Bounty OpenAI paid Hacktron after fixing identity infrastructure flaw in under 14 hours
• 4 hours Time for Claude autonomous agent to reproduce attack against remote test environment

Three security researchers at cybersecurity startup Hacktron chained an image-processing vulnerability with a flaw in OpenAI’s identity infrastructure to compromise multiple employee accounts and reach the company’s internal software repository in July, according to CryptoSlate. The researchers used Anthropic’s Claude AI model to identify and develop exploits, demonstrating how large language models can accelerate the timeline for sophisticated cyberattacks. The team deliberately stopped after instructing a compromised employee’s Codex account to create a harmless pull request inside OpenAI’s private repository, avoiding inspection of proprietary code. Hacktron disclosed the vulnerabilities this week, and OpenAI fixed the identity-side flaw within 14 hours of receiving the report, then paid the firm a $6,500 bounty.

Claude Opus 5 overcame the exploitation hurdle that trapped its predecessor

The breakthrough came when Anthropic released Claude Opus 5 on July 24, enabling the researchers to clear a critical technical barrier. Hacktron had begun examining OpenAI’s Discourse community forum on July 23, targeting HEIC and HEIF image files processed through ImageMagick and the libheif decoding library. The researchers used Claude Opus 4.8 to inspect the installed libheif package and identify missing security fixes, discovering a heap buffer overflow vulnerability.

By July 24, Opus 4.8 had produced an exploit achieving code execution when address space layout randomization was disabled. However, the model repeatedly failed to develop a working exploit that functioned reliably against Discourse’s normal configuration with ASLR enabled. Within hours of Opus 5’s release that same day, the new model produced a working ARM64 exploit for a local Mac within three hours, then successfully adapted it to the x86-64 architecture and jemalloc memory configuration used by Discourse.

Autonomous Claude agent reproduced the attack against remote systems in four hours

With a functional local exploit ready by 6 a.m. on July 25, the researchers tested whether Claude could automate the attack against a remote environment with minimal human direction. Hacktron placed the model in an autonomous loop against its own Discourse Cloud instance. The model initially refused to develop an exploit directly against a remote system, but the researchers reframed the test environment as a capture-the-flag security challenge, and the agent reproduced the attack within four hours.

The researchers then deployed the exploit against OpenAI’s community forum and gained administrative access. A separate weakness in OpenAI’s single-sign-on system allowed them to escalate from the forum into ChatGPT and Codex accounts. One compromised employee had connected Codex to OpenAI’s GitHub organization, providing the final pathway into the company’s internal repository. The team deliberately halted further investigation at that point.

AI-Assisted exploits compress Development timelines while raising stakes for coded systems

Mohan “s1r1us” Pedhapati, co-founder of Hacktron, said the breach showed how AI was compressing exploit-development timelines once requiring specialized expertise over months.

Our main takeaway from hacking OpenAI: AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days. Even leading AI labs can be vulnerable.

Mohan Pedhapati, Hacktron co-founder

Hacktron emphasized, however, that the operation still depended heavily on experienced human researchers to guide the process. Robert Reith, founder of blockchain security firm Accretion, acknowledged that skilled researchers supplied much of the judgment needed to convert AI-generated code into a working attack, but warned the advantage was temporary.

According to Reith: “There’s still a large gap between what skilled researchers + AI can do vs. general population + AI. The scary part is that this gap may become smaller as AI absorbs this knowledge and intuition over time.”

The breach also exposed a second vulnerability: coding agents like Codex and Claude Code connect to external services, meaning a compromised account can expose whatever integrations a user has authorized. In this case, the employee’s GitHub connection opened a direct path into OpenAI’s internal repository. The same architectural concentration creates risk as these tools become embedded deeper in corporate development workflows.

Codey Blakeney, research lead at Arcee, warned that popularity of these tools makes them increasingly attractive targets.

Blakeney cautioned that regulatory consolidation around fewer AI providers could amplify the damage from any single breach. Maxime Fournes, CEO of AI safety advocacy group PauseAI, noted a structural imbalance: attackers need to find one overlooked weakness, while defenders must secure an entire attack surface. According to him: “It’s massively harder and more expensive to defend against all possible flaws than to exploit a single one.” OpenAI tightened access controls after disclosure, while Discourse prepared a patch by July 27 and added further sandboxing around its image-processing system.

The BlockWest read. The incident reveals not just an operational security gap but a structural vulnerability in how AI coding tools concentrate permissions and attack surface. As these tools embed deeper into corporate development, a single compromised account becomes a gateway to multiple external services and internal systems. The real risk for institutions is not the speed of current attacks but whether their identity and access controls can scale to match the expanding blast radius of compromised AI agent accounts.

Discourse released its patch on July 27, and OpenAI has tightened access to prevent similar escalation. The open question is whether other companies running AI coding agents have similarly chained their identity infrastructure and external integrations in ways that could enable comparable attacks when new models reach comparable capability levels.

BlockWest is a news publication. Nothing here is investment advice. Read our disclaimer and editorial policy.