Security researchers used Claude to help them hack into OpenAI

Stevie Bonifield’s Verge report, citing the Wall Street Journal, says Hacktron researchers took less than 72 hours to compromise OpenAI employee accounts using Anthropic’s Claude Opus 4.8 and 5. They reached OpenAI’s GitHub “Monorepo,” described by WSJ sources as holding algorithmic secrets, stopped short of pulling internal code themselves, and sent a pull request from an employee’s Codex account to prove access.

Entry came through Discourse, which hosts OpenAI’s community forums, via a flaw in HEIF image processing. Hacktron says Claude Opus 5 launched the evening of July 24; by 10AM the next day they had RCE on Discourse Cloud and access to OpenAI’s instance. Their “HEIF Heist” adapted in one or two days to targets including Slack, Meta, GitHub Ent, Rails, Next.js, and ImageMagick, using under $3,000 in tokens; only Shopify detected them, to their knowledge.

Vulnerabilities reported to Discourse and OpenAI are fixed; OpenAI paid $6,500. Hacktron CTO Mohan Pedhapati told the WSJ they are “just three guys with Claude and Codex subscriptions,” not as strong as Chinese threat actors.

We’re glad this landed as a bug bounty instead of a silent exfil—and we’re done pretending frontier models are only a safety-board abstraction.

A HEIF parser bug plus Claude as a force multiplier is classic dual-use: useful for defenders who move fast, catastrophic when the other side has more than three people and a bigger budget. Reaching Monorepo adjacency through a community forum is an organizational failure as much as a CVE.

Useful AI includes AI-assisted security research that closes holes before nation-states do. The $6,500 payout next to sub-$3,000 token spend is a market signal: labs are underpricing the offense these tools enable. Pedhapati’s line should haunt every CISO still treating chatbot subscriptions as harmless.

I’m watching whether Discourse-class vendors harden media pipelines industry-wide, whether OpenAI changes forum and SSO boundaries, and whether model providers publish misuse telemetry for HEIF-style exploit workflows.

The Verge published on September 18, 2026. Hacktron framed the work as responsible disclosure after proving access without dumping Monorepo contents.