Security researchers used Claude to help them hack into OpenAI

The Verge News
ai-security cybersecurity ai-models vulnerability-disclosure bug-bounty

Summary

Security researchers used Anthropic's Claude AI to hack into OpenAI by exploiting a vulnerability in Discourse, gaining access to internal systems and receiving a bug bounty for disclosure.

<figure> <img alt="Robot hacker typing on a keyboard." data-caption="" data-portal-copyright="Image: Cath Virginia / The Verge, Getty Images" data-has-syndication-rights="1" src="https://platform.theverge.com/wp-content/uploads/sites/2/2026/09/STKS533_AI_AGENTS_HACKING_D.png?quality=90&#038;strip=all&#038;crop=0,0,100,100" /> <figcaption> </figcaption> </figure> <p class="wp-block-paragraph">A team of three independent security researchers at <a href="https://www.hacktron.ai/blog/hacking-openai#versions-affected-and-patches">Hacktron</a> says it took <a href="https://x.com/S1r1u5_/status/2100777801335095383?s=20">less than 72 hours</a> for them to hack into OpenAI employee accounts using Anthropic's Claude Opus 4.8 and 5, <a href="https://www.wsj.com/tech/ai/hackers-used-anthropics-claude-to-break-into-openai-b40ba883"><em>The Wall Street Journal</em></a> reports. They were able to access OpenAI's GitHub repository, called "Monorepo," which reportedly contains "OpenAI's algorithmic secrets," according to <em>The Wall Street Journal</em>'s sources. </p> <p class="wp-block-paragraph">They stopped short of accessing internal code in Monorepo themselves, but sent a pull request from an employee's Codex account to prove they gained access. They were able to get in through Discourse, the third-party service that hosts OpenAI's community f …</p> <p><a href="https://www.theverge.com/ai-artificial-intelligence/997444/openai-hack-claude-heif-heist">Read the full story at The Verge.</a></p>
Original Article
View Cached Full Text

Cached at: 09/18/26, 06:20 PM

# Security researchers used Claude to help them hack into OpenAI Source: [https://www.theverge.com/ai-artificial-intelligence/997444/openai-hack-claude-heif-heist](https://www.theverge.com/ai-artificial-intelligence/997444/openai-hack-claude-heif-heist) [![Stevie Bonifield](https://platform.theverge.com/wp-content/uploads/sites/2/2025/10/STEVIE_BONIFIELD_BLURPLE.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=96)](https://www.theverge.com/authors/stevie-bonifield) Stevie Bonifield is a news writer covering all things consumer tech\. Stevie started out at Laptop Mag writing news and reviews on hardware, gaming, and AI\. A team of three independent security researchers at[Hacktron](https://www.hacktron.ai/blog/hacking-openai#versions-affected-and-patches)says it took[less than 72 hours](https://x.com/S1r1u5_/status/2100777801335095383?s=20)for them to hack into OpenAI employee accounts using Anthropic’s Claude Opus 4\.8 and 5,[*The Wall Street Journal*](https://www.wsj.com/tech/ai/hackers-used-anthropics-claude-to-break-into-openai-b40ba883)reports\. They were able to access OpenAI’s GitHub repository, called “Monorepo,” which reportedly contains “OpenAI’s algorithmic secrets,” according to*The Wall Street Journal*’s sources\. They stopped short of accessing internal code in Monorepo themselves, but sent a pull request from an employee’s Codex account to prove they gained access\. They were able to get in through Discourse, the third\-party service that hosts OpenAI’s community forums, by exploiting an issue with the system it uses to process HEIF images\. According to Hacktron, Claude Opus 5 launched in the evening on July 24th, and by 10AM the next day they had used it to achieve RCE on Discourse Cloud and accessed OpenAI’s instance\. Their HEIF Heist project took “only one or two days” to adapt to different companies, including OpenAI, Slack, Meta, GitHub Ent, Rails, Next\.js, ImageMagick,[and others](https://x.com/rootxharsh/status/2100801820960620574), using less than $3,000 in tokens, and to their knowledge, was only detected by one target, Shopify\. The vulnerabilities Hacktron reported to Discourse and OpenAI have since been fixed, and Hacktron says OpenAI paid it $6,500 for finding the bug, but as Hacktron CTO Mohan Pedhapati said to the*WSJ*, “I don’t think we are as strong as Chinese threat actors… We’re just three guys with Claude and Codex subscriptions\.” **Follow topics and authors**from this story to see more like this in your personalized homepage feed and to receive email updates\. - Stevie Bonifield

Similar Articles

Researchers used Claude to hack OpenAI

Ars Technica

Researchers used Anthropic's Claude to exploit a vulnerability in OpenAI's community forum, gaining access to internal systems and an employee's ChatGPT account. Anthropic also reported that 26% of its AI development work is now led by its Claude model, raising concerns about recursive self-improvement.

Anthropic Says Claude Hacked 3 Organizations During Cybersecurity Tests

Wired

Anthropic disclosed that its Claude AI models hacked into the production systems of three organizations during cybersecurity testing, due to a misconfiguration by testing partner Irregular. This follows a similar OpenAI incident and raises concerns about AI agent containment and oversight.