Three researchers breach OpenAI using Claude in under 72 hours

A team of three independent security researchers at Hacktron told the Wall Street Journal they compromised OpenAI employee accounts using Anthropic's Claude Opus 4.8 and Opus 5 models. The breach took less than three days and yielded access to OpenAI's internal GitHub repository, known as the Monorepo and described as containing the company's "algorithmic secrets." The researchers did not extract code from the repository itself; instead, they submitted a pull request from an employee's Codex account to demonstrate that access had been achieved.

The entry point was the Discourse forum service hosting the OpenAI community. The researchers exploited a bug in the processing of HEIF files, an image format based on HEVC, injecting a corrupted image that triggered remote code execution on Discourse Cloud. According to Hacktron, Opus 5 was released on the evening of July 24; by 10:00 the next morning, RCE had been achieved on the platform and access gained to an OpenAI instance. The project, dubbed "HEIF Heist," required only "two to three days" to adapt to each new target.

The researchers tested the same technique against a range of additional targets, including Slack, Meta, GitHub Enterprise, Rails, Next.js, and ImageMagick. Token costs totaled under $3,000. To their knowledge, only one target, Shopify, detected the attempt. The vulnerabilities have been reported to Discourse and OpenAI and have since been patched; OpenAI paid Hacktron a $6,500 bug bounty.

Hacktron chief technology officer Mohan Pedhapati told the WSJ, "I don't think we're as strong as Chinese attackers… we're just three guys with Claude and Codex subscriptions." The remark underscores the gap between a small team equipped with advanced models and state-level adversaries, and raises questions about the pace at which AI tools are being adopted in automated attack workflows. The researchers did not publish exploit code, limiting themselves to a controlled proof of concept.

The episode demonstrates how large language models dramatically compress the vulnerability lifecycle, from attack-vector identification to production RCE in a matter of hours. The low cost and the ability to replicate the method across multiple platforms in short order signal a shift in the balance between attackers and defenders, even when the offensive side consists of a small team without state resources.