Uncovering Vulnerabilities: How Security Researchers Leveraged Claude to Breach OpenAI

Security Researchers Successfully Hack OpenAI Employee Accounts

In a recent report by The Wall Street Journal, a team of three independent security researchers at Hacktron claimed that they were able to hack into OpenAI employee accounts within a mere 72 hours. The researchers used Anthropic’s Claude Opus 4.8 and 5 to gain unauthorized access to OpenAI’s GitHub repository, known as “Monorepo,” which reportedly houses the organization’s “algorithmic secrets.”

Although the researchers did not directly access internal code within Monorepo, they were able to demonstrate their infiltration by sending a pull request from an employee’s Codex account. The breach occurred through Discourse, a third-party service hosting OpenAI’s community forums, where the researchers exploited a vulnerability related to the processing of HEIF images. Hacktron reported that they utilized Claude Opus 5 to achieve Remote Code Execution (RCE) on Discourse Cloud, gaining access to OpenAI’s instance.

The project, dubbed “HEIF Heist,” was quickly adapted to target various companies, including OpenAI, Slack, Meta, GitHub Ent, Rails, Next.js, and ImageMagick. The researchers were able to execute the hack using less than $3,000 in tokens. Hacktron noted that only one target, Shopify, detected the breach. Following the disclosure of vulnerabilities, both Discourse and OpenAI promptly addressed the issues. OpenAI reportedly rewarded Hacktron with a $6,500 bounty for identifying the bug.

Despite their successful penetration, Hacktron’s CTO Mohan Pedhapati emphasized that they do not possess the capabilities of more sophisticated threat actors, stating, “We’re just three guys with Claude and Codex subscriptions.” The incident serves as a reminder of the ongoing challenges organizations face in safeguarding sensitive data against evolving cybersecurity threats.