Researchers Broke Into OpenAI's Code Using Claude. OpenAI Paid Them $6,500.

On July 25, 2026, three researchers at a security startup called Hacktron used Anthropic's Claude to break into OpenAI's internal code repository. The full path, from an unpatched image-processing bug to a pull request inside OpenAI's monorepo, took under 72 hours. OpenAI's bug bounty program paid them $6,500.

The exploit chain

Hacktron's own writeup of the breach names the opening: a heap buffer overflow in libheif, the library that Discourse, the forum software OpenAI uses for community support, relies on to decode HEIC images through ImageMagick. Turning that kind of bug into working attack code is normally slow, specialized work. Claude Opus 4.8, Anthropic's model at the time, tried and failed for days, unable to produce exploit code that survived the operating system's address space randomization defenses, according to comments Hacktron founder Mohan Pedhapati gave [TechCrunch](https://techcrunch.com/2026/09/18/researchers-used-anthropics-claude-to-hack-into-openai/).

Anthropic released Opus 5 on July 24. Hacktron gave the new model the same problem it had handed Opus 4.8, and according to [the firm's blog post](https://www.hacktron.ai/blog/hacking-openai), it wrote working ARM64 attack code targeting a local Mac within three hours of release. The team then asked it to port the exploit to x86-64 for OpenAI's Discourse environment. By 6 a.m. UTC on July 25, after one overnight session, the model had produced remote code execution through a malicious image upload.

From a help forum to the source code

The second flaw sat in how OpenAI's community forum handled its Sign in with OpenAI feature, an SSO misconfiguration that let anyone who compromised the forum pivot into employee-linked ChatGPT and Codex accounts. Hacktron used one such account's Codex credentials to open pull request 1186742 in OpenAI's internal monorepo, proof of access that stopped short of touching anything sensitive. Matt Fredrikson, CEO of the AI security firm Gray Swan, told [TechCrunch](https://techcrunch.com/2026/09/18/researchers-used-anthropics-claude-to-hack-into-openai/) the barrier to this kind of attack has effectively disappeared: "For $200 a month, anyone can use these tools and hack into a company like OpenAI."

A tense disclosure

The technical fix moved fast. OpenAI confirmed a patch within a day, and Discourse published its own security advisory three days later. The disclosure conversation went worse. Fabian Faessler, Hacktron's head of agent engineering, said OpenAI asked the team to remove a screenshot proving employee account access from its report, and that chief information security officer Dane Stuckey called the draft a "stunt document." Stuckey later apologized after Faessler wrote about the exchange publicly. An OpenAI spokesperson's only public comment was that the company "thanks the researchers for contacting us and sharing their findings."

OpenAI's response was bigger than the patch

OpenAI's operational response went past a code fix. President Greg Brockman said the company pulled a quarter of its production engineers off their existing work and put them on defense. "Sorry, all your projects are on hold," Brockman said he told them. "You are now defending. You are now upleveling our security architecture."

“Sorry, all your projects are on hold. You are now defending. You are now upleveling our security architecture.”

For a vulnerability chain that reached OpenAI's own source code, $6,500 is on the low end of what comparable bugs pay elsewhere. Google's top reward for a comparable zero-click chain against a Pixel phone's security chip is $1.5 million. Microsoft's largest single bounty payout in the twelve months ending June 2026 was $200,000. OpenAI's bug bounty program is newer and smaller than either, and the company has not said whether it plans to raise its top payouts.

The bigger claim

[Hacktron's own conclusion](https://www.hacktron.ai/blog/hacking-openai) reaches past OpenAI specifically. "AI is removing that protection by turning more of this scarce expertise into compute," the researchers wrote. "Work that once required a well-resourced team and months of effort can now be compressed into days." Frank Cilluffo, director of Auburn University's McCrary Institute for Cyber and Critical Infrastructure Security, called the episode a warning shot, arguing that foreign intelligence services are likely already running similar campaigns against AI companies without ever publishing a blog post about it. OpenAI has not publicly disputed that broader claim. Its pushback was over how the finding was disclosed, not whether the underlying risk exists.

A three-person outside team reached the source code of the company that OpenAI's own executives describe as building toward artificial general intelligence, using a mainstream chatbot and a bug in forum software neither team wrote. It took them three days and cost less than a used laptop. OpenAI's own response, a code red and a quarter of its engineering staff reassigned, is the clearest sign yet that the company agrees with Hacktron's math, even if it will not say so directly.