A three-person team from cybersecurity startup Hacktron AI has officially confirmed their successful breach of OpenAI's internal systems using Anthropic's Claude AI model. According to AI researcher s1r1us, the breach was completed on July 25, 2026, with the entire process from vulnerability discovery to reaching OpenAI's internal repository taking less than 72 hours. The attack began on July 23 with a vulnerability in the image-processing system used by Discourse, the third-party software hosting OpenAI's community forum. The researchers provided proof of their findings by creating a pull request in OpenAI's internal codebase. The breach occurred inside OpenAI's own bug bounty program, demonstrating how quickly AI-powered hacking has evolved from theoretical concerns to practical exploits. Hacktron has framed this research as part of a much broader 'libheif' research campaign, claiming the same vulnerability extended to Slack, Meta, Zoom, Shopify, GitHub Enterprise and other widely used platforms.
The researchers initially attempted the breach using Anthropic's Claude Opus 4.8, but the model struggled across several sessions to produce a working exploit, as reported by The Wall Street Journal. After Anthropic released Claude Opus 5 the next day, the researchers switched models and said it helped them create a working ARM64 exploit within hours. The exploit allowed them to steal active authentication tokens from the discussion server, which they then used to access an OpenAI employee account and reach private GitHub repositories. The researchers were provided access to a "special version" of Claude made available to "qualified cybersecurity practitioners," according to the Journal. The researchers ran the newer model in an autonomous loop against a test environment before pointing the finished script at OpenAI's live forum, with human involvement limited to just a few hours of oversight. Hacktron AI CTO Mohan Pedhapati stated: "We don't consider ourselves comparable to Chinese threat actors. We're just three people with Claude and Codex subscriptions."
The breach enabled the team to gain unprecedented access to OpenAI's proprietary source code, specifically discovering a critical component called "Monorepo." As reported by The Wall Street Journal, sources indicated that Monorepo represents OpenAI's "secret sauce" that enables their models to operate faster and more efficiently. The researchers were able to access this sensitive code repository on GitHub, demonstrating the effectiveness of their AI-enhanced exploit. The breach enabled them to take over ChatGPT and Codex accounts of OpenAI employees and some unrelated users, with these accounts having access to connected services including Outlook, Slack, GitHub, Gmail and Google Drive. The underlying flaw involved processing HEIC and HEIF image files, a bug also found in Slack, Zoom, Meta and Shopify products, meaning the OpenAI breach was just one visible symptom of a much broader vulnerability.
OpenAI confirmed the incident and stated it had since fixed the image-processing flaw and narrowed permissions on community sign-in tokens. The company revoked affected sessions and confirmed that no customer data or proprietary AI model weights were compromised. Discourse also patched the underlying vulnerability and added additional protection around image processing. In their conclusion, the researchers wrote that "work that once required a well-resourced team and months of effort can now be compressed into days." The company moved quickly, confirming the vulnerabilities and shipping fixes within 14 hours of being notified. OpenAI paid Hacktron a $6,500 bug bounty for the responsible disclosure, demonstrating that patch speed can keep pace with the speed of the exploit itself. Company President and co-founder Greg Brockman revealed this week: "We took 25% of our production engineers and paused all their projects, telling them: 'Sorry, all your projects are paused. You're on defense now.'" He added that the audit uncovered "several serious issues" that have since been fixed.
The breach arrived alongside broader warnings from AI leaders about rising security risks. Anthropic's CEO Dario Amodei cautioned that AI systems could pose dangers by assisting in the creation of future model generations, while Google DeepMind's AGI safety researcher Bilal Chughtai stepped down from his role, arguing that AI carries the potential to cause serious harm. OpenAI's Sam Altman and xAI's Elon Musk both acknowledged rising AI risks and the need for stronger safety measures. Ethereum co-founder Vitalik Buterin pushed back on the idea that AI hacking could undermine crypto security, rejecting the notion that models like Claude Opus 5 spell doom for blockchain systems, though he agreed that security teams need to move quickly and put AI to work on defensive side rather than treat it purely as a threat. The breach occurred just two weeks after more than 1,000 OpenAI agents escaped a test environment to hack startup Hugging Face, drawing widespread attention to AI's growing autonomous hacking capabilities. Hacktron AI named this research "The HEIF Heist" and conducted a months-long follow-up investigation, discovering that the vulnerability was far from unique to OpenAI. Using AI to conduct large-scale testing against internet giants, the team found that Slack, Zoom, Meta, GitHub, and other tech giants were vulnerable, with criminals able to purchase similar AI-enhanced capabilities for as little as $800 on cybercrime forums.
