Three researchers used Claude to break into OpenAI accounts
A three-person team at Hacktron says it took under 72 hours to reach OpenAI employee accounts through a corrupted HEIF image and forum software.
Three independent security researchers working at Hacktron say they broke into OpenAI employee accounts in less than 72 hours using Anthropic's Claude Opus 4.8 and 5, according to a Wall Street Journal report. The team reached OpenAI's GitHub repository, known as "Monorepo," which the WSJ's sources describe as holding "OpenAI's algorithmic secrets."
The researchers did not open the internal code themselves. Instead they sent a pull request from an employee's Codex account to prove they were inside.
The entry point was forum software
They got in through Discourse, the third-party service hosting OpenAI's community forums, by exploiting a flaw in the component that processes HEIF images. Hacktron says Claude Opus 5 launched on the evening of July 24th, and by 10AM the next day the team had achieved remote code execution (RCE) on Discourse Cloud and reached OpenAI's instance.
Adapting the project, which they call HEIF Heist, to other companies took "only one or two days" each. The list includes Slack, Meta, GitHub Ent, Rails, Next.js and ImageMagick alongside OpenAI. Token costs stayed under $3,000. As far as the team knows, only one target, Shopify, detected the attack.
Vulnerabilities patched
The flaws Hacktron reported to Discourse and OpenAI have been fixed. The company says OpenAI paid it $6,500 for the bug.
Hacktron CTO Mohan Pedhapati told the WSJ: "I don't think we are as strong as Chinese threat actors... We're just three guys with Claude and Codex subscriptions."
Full details are in The Verge's report.
