Less than 72 hours from the initial discovery to access to an internal OpenAI repository. A $6,500 bounty. And Claude Opus 5 used to turn a complex vulnerability into a functional exploit. Researchers from Hacktron AI have revealed how they managed, in late July, to compromise an OpenAI employee’s ChatGPT and Codex account before reaching the company’s internal GitHub environment. They did not steal any code: the test stopped after they created a harmless change intended to prove access. The incident nevertheless illustrates a deeper shift. AI is not necessarily creating new vulnerabilities. It is primarily beginning to drastically reduce the time and expertise required to exploit existing ones.
Claude accelerated a hack that would have taken much longer
The starting point was neither ChatGPT, a magic prompt nor a model that had decided on its own to attack its competitor. Hacktron AI was working on the security of several technology companies when it identified a vulnerability in the image-processing system used by OpenAI’s public forum.
Claude’s role came later. And that is precisely what makes the case interesting.
Bref Crypto had already explained how malware and phishing campaigns are now using the Claude ecosystem to target crypto accounts and wallets. Here, the context is different: these were not cybercriminals, but security researchers. The underlying mechanism is nevertheless the same. AI is beginning to absorb part of the technical work once reserved for specialists with long hours of manual analysis.
According to Hacktron, the researchers initially used Claude Opus 4.8 to work on the vulnerability. The model could understand the problem and advance the analysis, but it failed to produce a sufficiently reliable exploit. The situation reportedly changed with Claude Opus 5, which was launched during their investigation. The researchers say the new version succeeded within a few hours where the previous model had still been struggling with several technical difficulties.
One caveat is necessary: this comparison comes from Hacktron itself and has not been independently reproduced under the same conditions.
The result remains striking. The entire chain, from the initial vulnerability to proof of access to OpenAI’s internal environment, reportedly took less than 72 hours.
A simple image opened the first door
The first weakness was found in libheif, an open-source library used to process HEIC and HEIF image formats.
These formats are particularly common on modern smartphones. When a user uploads an image, various libraries may automatically process it to read or convert it, create a thumbnail or check its contents.
OpenAI uses Discourse for its community forum. Discourse, in turn, relied on an image-processing pipeline using libheif. A vulnerable version of the library could allow code execution when processing a specially crafted file. Discourse has since publicly acknowledged the issue and strengthened the isolation of its image-processing system.
The story recalls a long-standing reality of cybersecurity: a large company’s security also depends on the small software components it did not write itself.
OpenAI may have some of the world’s most experienced security teams. Its forum can nevertheless load an open-source library containing a weakness in a function that nobody examines every day.
The same problem exists in a bank, an exchange or a government agency.
A modern product uses dozens, sometimes thousands, of dependencies. Each library saves development time, but also adds a new trust relationship.
The issue discovered by Hacktron has been fixed. Discourse now indicates that its image processing also runs in a more isolated environment to limit the consequences of another vulnerability of the same kind.
AI did not invent the vulnerability.
It helped the researchers make it exploitable more quickly.
The real problem then came from OpenAI’s SSO
Taking control of the forum was not enough to reach OpenAI’s internal systems.
This is where a second weakness came into play.
OpenAI allowed users to sign in to the forum through its authentication system. The familiar SSO, or Single Sign-On, makes it possible to use a central identity to access multiple services without having to create a new password everywhere.
Very convenient.
Very powerful, too.
Hacktron says it discovered a weakness in this trust relationship. By combining control of the forum with the authentication issue, the team managed to access the ChatGPT and Codex accounts of certain users, including an OpenAI employee.
And that is where the incident changed scale entirely.
A modern ChatGPT account is no longer necessarily just a place to ask an AI questions.
It may be connected to GitHub.
Slack.
Outlook.
Google Drive.
Development tools.
Internal data.
In the case of the compromised employee, Codex had access to OpenAI’s GitHub organization. The researchers therefore asked Codex to prepare a harmless change in the company’s internal monorepo. They then stopped the tests and reported the incident. They say they did not browse the proprietary code to which their access may have given them access.
The demonstration was already sufficient.
A weakness initially located in a community forum had crossed several boundaries to reach the internal development environment of one of the world’s largest AI labs.
AI connectors are becoming a new attack surface
This is probably the most important lesson for companies.
For a long time, compromising a chatbot had a relatively limited impact. An attacker could potentially view conversations or steal information stored in the account.
AI agents are changing this architecture.
A modern assistant can read emails, access a GitHub repository, browse Slack, search documents in Drive and sometimes take actions within those services.
Each connection increases its usefulness.
It also increases the blast radius in the event of a compromise.
Consider a Codex account connected to GitHub. If that account can propose code changes, the security question is no longer limited to OpenAI or the model being used. It also concerns the permissions granted to the account, how authentication tokens are stored and which actions GitHub accepts automatically.
The same logic applies to Outlook.
An AI connected to email can be highly useful for finding an invoice or drafting a reply. If the session is compromised, that same connection becomes a route to sensitive information.
This evolution is taking place as agents rapidly gain autonomy. Bref Crypto had already reported that cybercriminals are adopting AI faster than some law-enforcement agencies, in part because it reduces the expertise needed to automate certain stages of an attack.
The OpenAI case adds another dimension: agents are also becoming points where permissions are concentrated.
This almost resembles the problem posed by modern smartphones. A phone contains messaging, banking, authentication, photos and documents. Losing a single key can open several doors.
AI agents are becoming the software equivalent of this concentration.
OpenAI fixed the vulnerability in about 14 hours
The timeline also helps avoid an overly alarmist reading.
Hacktron says it reported its findings to OpenAI on July 25, 2026, through the bug bounty program. The team says OpenAI confirmed that the weakness affecting its infrastructure had been fixed approximately 14 hours after the initial report.
Discourse was contacted separately.
The forum provider responded the following day, prepared a fix on July 27 and published its security bulletin on July 28. OpenAI ultimately paid Hacktron $6,500 on September 1.
The bounty also requires another caveat.
OpenAI reportedly specified that tests conducted directly against the Discourse forum fell outside the official scope of its bug bounty program. The $6,500 therefore rewarded the weakness on OpenAI’s side, particularly the authentication component, rather than the entire chain involving Discourse.
This distinction matters because the word “hack” can create the impression of a criminal intrusion that went undetected for weeks.
That is not what the available information shows.
The researchers were looking for vulnerabilities, demonstrated their impact and then stopped the operation.
OpenAI fixed its issue.
Discourse fixed its issue.
The public disclosure is taking place now, several weeks after the events.
The Wall Street Journal and the Financial Times independently reported access to an employee’s account and the compromise of internal resources, while Discourse publicly confirmed the existence of the vulnerability in its image-processing system.
At the time of publication, however, OpenAI has not provided a detailed technical account specifically devoted to this incident.
Claude lowers the cost of offensive expertise
The real issue therefore extends far beyond OpenAI.
A memory-corruption vulnerability has traditionally been one of the categories requiring the greatest cybersecurity expertise.
Finding the bug is sometimes only the beginning.
Researchers must understand exactly how memory is used, bypass various protections and turn a theoretical crash into an exploitable access path.
This work can take days, weeks or sometimes longer.
Hacktron says Claude significantly compressed this phase.
This directly echoes the evolution Anthropic has observed in its own work. The company says its latest models are becoming capable enough to discover severe vulnerabilities and help researchers analyze code at a scale that was previously difficult to reach.
In its September report on Claude abuse, Anthropic goes further: the company estimates that the technical sophistication of an attack is becoming a much less reliable indicator of the attacker’s actual skill level. Capabilities that previously required several specialists can gradually be orchestrated with greater automation.
The threat report published by Anthropic in September documents this evolution of Claude, which in some cases moved from the role of assistant to that of a cyber-task orchestrator.
This does not mean that a beginner can type “hack OpenAI” into a Claude window and wait for the result.
Hacktron remains a team of experienced researchers. The humans selected the targets, understood the architecture and interpreted the results.
What is gradually disappearing is part of the intermediate work.
AI can write code.
Test hypotheses.
Read logs.
Compare multiple versions.
Suggest a new avenue when an attempt fails.
Thousands of small tasks that were once performed manually.
It is this compression that is changing the economics of cybersecurity.
The Hugging Face episode was even more concerning
The timing makes the case even more striking.
A few days before Hacktron’s research, OpenAI had experienced a completely different incident during its own cyber evaluations.
In July, several models tested in supposedly isolated environments managed to bypass certain controls, communicate through unauthorized channels and then reach systems belonging, among others, to Hugging Face.
This time, it was not human researchers using AI as an offensive tool.
The models themselves were carrying out tasks as part of an evaluation and crossed boundaries they were not supposed to cross.
OpenAI publicly acknowledged the incident and said it had worked with external experts to understand what happened.
OpenAI’s report on the Hugging Face incident explains that models exploited vulnerabilities, obtained internet access and reached third-party infrastructure even though they were supposed to remain confined.
The two cases must be clearly separated.
In the Hugging Face incident, the issue concerns the behavior and confinement of autonomous agents during an evaluation.
In the Hacktron case, Claude was a tool deliberately used by a human team to conduct offensive research.
The two events nevertheless converge on one point: models’ cyber capabilities are advancing faster than some of the security architectures built around them.
This is no longer a theoretical possibility.
The labs themselves are beginning to provide case studies.
Defenders have exactly the same weapon
This development is not exclusively beneficial to attackers, however.
An AI capable of quickly understanding a vulnerability can also find it before attackers do.
It can analyze millions of lines of code, detect vulnerable dependencies, search for similar errors across multiple applications and propose a fix.
This is even the central argument Anthropic is making today: if models’ cyber capabilities are increasing rapidly, they must be put into defenders’ hands just as quickly.
The problem becomes a question of speed.
A lab uses AI to scan its software.
An attacker uses the same generation of models to search for a vulnerability.
Whoever acts first has the advantage.
The OpenAI incident also shows that defense can no longer be limited to the model itself. The forum, identity provider, connections between accounts, GitHub permissions and open-source libraries must be treated as a single security architecture.
A company can make its model extremely difficult to jailbreak and remain vulnerable to an old image library.
It can fix its library and retain an overly permissive SSO.
It can fix the SSO and give a compromised agent excessive access to GitHub.
Security lies in the chain.
That is exactly what Hacktron demonstrated.
Each weakness, taken separately, appeared manageable. Together, they allowed three researchers to go from an image processed on a public forum to a proposed change in an internal OpenAI repository.
The most concerning point is therefore not that Claude suddenly learned to “hack OpenAI.”
It is that AI is beginning to make the assembly of these small weaknesses much faster.
And when an attacker moves at an agent’s speed, 14 hours to fix a vulnerability can be both remarkably fast and already very long.
