A three-person security research team, Hacktron AI, leveraged Anthropic's Claude to penetrate OpenAI's systems in July, according to an exclusive report by The Wall Street Journal. The initial exploit targeted a flaw in OpenAI's community forum software, but the more significant revelation came when the team combined that with a weakness in OpenAI's single-sign-on (SSO) system, ultimately gaining access to internal developer infrastructure.
From forum flaw to internal repository
The researchers first exploited a vulnerability in Discourse, the platform powering OpenAI's community forum, specifically in how it processed HEIC and HEIF image uploads. This exposed the libheif image decoder through ImageMagick. With Claude's assistance, Hacktron identified missing security backports and developed a working exploit that turned a memory-corruption bug into remote code execution against the forum environment.
That initial foothold was escalated when the team discovered a separate weakness in OpenAI's SSO system, which allows users to access multiple services with one account. By chaining these vulnerabilities, they reached ChatGPT and Codex accounts, including one belonging to an OpenAI employee. That employee's Codex account was linked to GitHub, where OpenAI stores its code, allowing the researchers to demonstrate access to OpenAI's internal GitHub organization.
AI compresses the attack timeline
Hacktron's chief technology officer, Mohan Pedhapati, told The Wall Street Journal, "We're just three guys with Claude and Codex subscriptions." The full path from discovery to repository access took less than 72 hours, and the entire research campaign cost under $3,000 in model tokens. While skilled human guidance remained essential, the episode illustrates how frontier coding models can compress work that once required more specialist labor, time, and infrastructure.
Instead of reading proprietary source code, the researchers instructed Codex to make a harmless change and open a pull request inside OpenAI's internal monorepo, proving their access. OpenAI confirmed the issue was fixed about 14 hours after the initial report and later paid a $6,500 bounty for the OpenAI-side finding.
Broader implications for cybersecurity and AI
The Hacktron team operated as white-hat researchers, but the same techniques could be used by malicious actors. Anthropic's September threat report noted it had disrupted cyber operations where actors used Claude for reconnaissance, exploitation, malware development, and data theft. The company said AI enables adversaries to operate faster, across broader attack surfaces, and with fewer resources.
Jack Nelson, chief information security officer at Ivanti, told Axios that "a swarm does not need to be perfect to be dangerous," adding that thousands of agents making merely adequate decisions at machine speed could still cause meaningful disruption. This incident underscores a growing concern: AI is lowering the cost of sophisticated cyberattacks, and interconnected identity and developer tools can amplify the impact of a single compromised account.
For investors, this case highlights the dual-use nature of AI in cybersecurity. While companies like OpenAI and Anthropic are investing heavily in AI safety, the same models can be repurposed for offensive operations. The alignment on AI safety coordination among major labs is a step forward, but the speed of exploitation demonstrated here suggests that defensive measures must evolve just as quickly.
OpenAI and Discourse have since fixed the vulnerabilities, making this a successful responsible-disclosure case. However, the episode leaves an uncomfortable lesson: AI can make exploitation cheaper and faster, and the next team may have no reason to stop at a harmless pull request. As Claude's role in sensitive projects expands, the stakes for securing AI systems grow ever higher.
This article is for informational purposes only and does not constitute financial advice.
