OpenAI Was “Ethically Hacked” With Claude: 3 Researchers, 72 Hours, a $6,500 Bounty

What Happened: Claude Helped Hack OpenAI

On September 18, 2026, The Guardian and The Wall Street Journal reported the day's biggest AI headline: cybersecurity researchers had “ethically hacked” OpenAI — with help from Anthropic's Claude.

A three-person team at US-based security startup Hacktron AI — Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini — compromised multiple OpenAI employees' ChatGPT accounts, gained access to OpenAI's software cache, and proved it with a harmless “pull request” to OpenAI's repository environment on GitHub.

The operation, conducted under OpenAI's bug bounty program, took less than 72 hours from discovery to repository access. The team immediately stopped, disclosed everything, and collected a $6,500 bounty. OpenAI fixed its side of the flaw within roughly 14 hours.

The irony writes itself: one frontier AI lab's model was the decisive weapon in breaking into another — and the researchers didn't even need to be exploit specialists, because Claude did the hardest part.

How the Attack Chain Worked: From a Photo to a Monorepo

The chain started not at OpenAI itself but at its community forum, hosted on the Discourse platform:

1. The image bug: A specially crafted HEIF/HEIC image upload exploited a flaw in Discourse's image-processing pipeline (the libheif library), giving remote code execution on the forum server.
2. Token theft: With server access, they harvested users' login tokens — essentially “already-logged-in” credentials.
3. The identity flaw: Those forum tokens had dangerously broad permissions, working on the same users' ChatGPT and Codex accounts. Some belonged to OpenAI employees.
4. The reach into GitHub: One employee account had Codex connected to OpenAI's GitHub — a path into the internal monorepo (not model weights).
5. The proof: The team made one harmless documentation edit inside the openai/openai repository, then halted and reported.

“Until two months ago, any user or OpenAI employee logging into OpenAI's own help forum could have had their ChatGPT and Codex accounts taken over,” the researchers wrote. “Since people can connect various services to Codex and ChatGPT, the scope of what we could theoretically access was huge, including GitHub, Slack and emails.”

The Opus 5 Moment: Why the Model Made the Difference

The most striking detail is how the exploit was built. The researchers first tried Claude Opus 4.8 to investigate the vulnerable libheif package. It couldn't: its exploit code failed against address-space layout randomization (ASLR), a standard memory-protection defense.

Then Anthropic released Claude Opus 5 on July 24, 2026, a major step up for long-running coding and agentic work. Hacktron switched models. Opus 5 produced a working ARM64 exploit within hours, then adapted it to the x86-64 and jemalloc environment used by Discourse. Discovery to internal-repository access: under 72 hours.

That's the real headline inside the headline: the gap between “AI can help with security research” and “AI can reliably weaponize a memory-corruption bug against hardened targets” closed between one model generation and the next. Tools like Claude Code, OpenAI Codex, and Cursor are marketed for shipping features — but the same agentic coding capability is a general-purpose exploit factory.

The Real Problem: Overprivileged Login Tokens

Strip away the AI angle and this is a story about a boring, decades-old security failure: overly broad session permissions. A forum token should never grant access to ChatGPT accounts, Codex environments, and GitHub integrations.

The pattern matters for every company wiring AI tools into their stack. Coding agents like GitHub Copilot and Codex are built to connect to your repositories, cloud accounts, and internal services. When those connections ride on tokens with excessive scope, every upstream service becomes a launchpad — exactly what Hacktron demonstrated.

AI Coding Agents Are Rewriting the Economics of Hacking

Reliable memory-corruption exploits against ASLR-hardened targets used to require scarce, expensive expertise — the kind found in nation-state labs or top-tier vulnerability brokers. The Hacktron operation shows a three-person startup matching that output in a weekend with an off-the-shelf AI assistant subscription.

Defenders should take no comfort in the fact that this was a white-hat operation. The same capability would have let a criminal group quietly mine OpenAI's internal code — and it's no coincidence that AI-lab leaders, including Anthropic's own Dario Amodei this week, are simultaneously calling for slower development of the most powerful systems.

How to Protect Yourself and Your Team

• Scope every token: Audit what your forum, SSO, and session tokens can reach. Least privilege isn't optional when AI agents hold the keys.
• Segment agent connections: Run AI coding agents in sandboxes and separate worktrees so a compromised session can't walk into your monorepo.
• Patch image pipelines: Image-decoding libraries (libheif, libwebp) remain a top RCE vector. If you run Discourse or any upload-handling service, update now.
• Hunt your own bugs with AI: Attackers already use frontier models to find your vulnerabilities. AI-assisted red teams are now table stakes.
• Watch dependency reach: Services connected to coding agents (GitHub, Slack, email) inherit the agent's trust level. Disconnect what you don't need.

Frequently Asked Questions