Researchers Say Claude Helped Three People Reach OpenAI Accounts in Under 72 Hours

Introduction

AI is lowering the amount of time required for some forms of vulnerability research. According to The Wall Street Journal, as reported by The Verge, the three-person independent security group Hacktron says it used Anthropic’s Claude Opus 4.8 and 5, along with OpenAI’s Codex, to reach OpenAI employee-related accounts in under 72 hours. The important point is not that a model independently “hacked OpenAI.” Rather, the case shows how a capable coding model can accelerate the repetitive parts of finding, adapting, and validating an exploit chain.

Key points

• Hacktron began with Discourse, the third-party service hosting OpenAI’s community forums. The team says it exploited a weakness in the way the system processed HEIF images and achieved remote code execution on Discourse Cloud.
• The researchers claim Claude Opus 5 launched on the evening of July 24 and that, by 10 a.m. the following day, they had used it to reach the relevant Discourse instance.
• From there, the team says it obtained a path into OpenAI’s GitHub environment and accessed the repository known as “Monorepo.” The repository has reportedly been described as containing OpenAI’s algorithmic secrets. Hacktron says it did not read the internal source code; instead, it submitted a pull request from an employee’s Codex account to demonstrate that access had been obtained.
• Hacktron says its “HEIF Heist” project took only one or two days to adapt to targets including OpenAI, Slack, Meta, GitHub Enterprise, Rails, Next.js, and ImageMagick. The team estimates that the work cost less than $3,000 in model tokens and says Shopify was the only target it knew to have detected the activity.
• The vulnerabilities reported to Discourse and OpenAI have since been fixed. Hacktron says OpenAI paid $6,500 for the report.

Why it matters

The case illustrates how AI coding assistants can compress the routine work involved in offensive security. A researcher may need to inspect an image-processing pipeline, construct malformed inputs, revise proof-of-concept code, and adjust it to different environments. A model can help explain unfamiliar code, identify likely failure points, generate variations, and speed up the feedback loop. Human oversight remains necessary, but the total time needed to move from an idea to a working demonstration may be much shorter.

It also highlights the diffusion risk of advanced models. Hacktron’s CTO described the team as “just three guys with Claude and Codex subscriptions,” while saying they were not as capable as sophisticated threat actors. That is a statement from the researchers, not an independently verified measurement. Still, it points to a broader concern: if effective security assistance is available through ordinary subscriptions, exploit-development capabilities may spread beyond large, well-funded groups.

The available account also has important limits. The details come primarily from Hacktron and The Wall Street Journal’s reporting. They do not establish that the researchers read Monorepo’s internal code, nor that Claude completed the attack autonomously. The more defensible description is that people selected the targets, directed the work, validated the outcomes, and used models to accelerate analysis and iteration.

For companies, the incident is a reminder that third-party services, media parsers, and employee credentials can form one connected attack path. Patching quickly, limiting service-account privileges, monitoring unusual pull requests, and auditing AI-assisted security automation may be as important as protecting the network perimeter.

Source: The Verge AI