Researchers Used Anthropic's Claude to Breach OpenAI's Internal Systems

Tool used: Independent researchers used Anthropic's Claude to chain together software flaws and access OpenAI's internal systems.

Access reached: They compromised an OpenAI employee's ChatGPT account and reached the company's private code repository.

Disclosure outcome: The team reported the flaws responsibly; OpenAI patched them and paid a bug bounty.

Independent security researchers at Hacktron AI used Anthropic's Claude to break into OpenAI's internal systems by chaining two critical vulnerabilities, gaining access to an OpenAI employee's ChatGPT account and the company's private software repository.

The researchers leveraged a heap overflow and a Single Sign-On (SSO) misconfiguration to achieve remote code execution ( RCE ) and compromise OpenAI's internal repositories.

Claude-Assisted Exploit Chain Reaches Internal Code

Researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini at security firm Hacktron AI used Claude to help develop an exploit for a vulnerability in Discourse, the forum software behind OpenAI's developer community, as reported by the Wall Street Journal. " We're just three guys with Claude and Codex subscriptions ," Mohan Pedhapati told The Journal.

Chaining that flaw with a separate SSO weakness gave them access to an OpenAI employee's ChatGPT account, and from there, a path to read and propose changes to OpenAI's internal software repository.

The researchers said they spent under $3,000 in AI tokens to build the exploit chain, which started with the libheif image decoder RCE. “ Until two months ago, any user or OpenAI employee logging into OpenAI’s own help forum could have had their ChatGPT and Codex accounts taken over ,” they said.

“ We’ve since expanded the research into HEIF Heist, a multi-month investigation tracing libheif across Slack, Meta, GitHub Enterprise, Ruby on Rails, and Node.js frameworks such as .js, Astro, and Gatsby ,” the blog said. “ A surprising amount of widely-used software depends on this one image-processing library .”

Responsible Disclosure, Not a Malicious Attack

Hacktron reported the vulnerabilities to OpenAI and Discourse rather than exploiting them further. OpenAI fixed the underlying issue and paid the researchers a bug bounty for the disclosure.

To demonstrate the extent of the access without exposing sensitive code, the team had a compromised employee's connected coding assistant open a single benign pull request inside OpenAI's internal repository.

If you self-host Discourse, rebuild your installation now. Older Docker images may contain a vulnerable dependency that permits code execution through an image upload.

Run git pull followed by ./launcher rebuild app from /var/discourse ; a web-interface update alone may not replace the underlying image.

Discourse-hosted customers have already been patched after the security advisory was released.

Part of a Broader Pattern of AI-Assisted Security Incidents

The disclosure follows, by roughly two months, a separate incident in which OpenAI's own AI agents broke out of a test environment and compromised Hugging Face's infrastructure in July 2026. JFrog confirmed its own Artifactory zero-days were exploited by GPT-5.6 Sol and an unreleased pre-release model that escaped to hack Hugging Face .

This month, Anthropic disclosed another Claude AI hacking incident , and OpenAI confirmed a Wiki incident , announcing plans for a new framework for AI misalignment disclosures.

In late July, Anthropic said Claude Opus 4.7, Mythos 5, and a research model broke out of test environments and hacked real companies.