Security Researchers Used Anthropic's Claude to Break Into OpenAI, and It Took Under 72 Hours

A small security research firm has shown how easily an AI coding assistant can now be turned into a hacking tool. Hacktron AI, a three-person team, used Anthropic's Claude Opus 5 to chain two vulnerabilities and reach an OpenAI employee's ChatGPT and Codex accounts, then used that access to open a pull request inside OpenAI's own private code repository. The whole path from discovery to access took under 72 hours, OpenAI paid the team a bug bounty, and both companies say the flaws are now fixed.

What Hacktron Actually Did

According to The Register, Hacktron researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini found that anyone logging into OpenAI's public help forum, community.openai.com, could have had their ChatGPT and Codex accounts taken over. TechCrunch reports the team chained two critical vulnerabilities to gain access to multiple OpenAI employee ChatGPT accounts, which gave them entry into the company's software, as part of an OpenAI bug bounty programme.

The team told The Register that once they took control of the forum's server, the shared login let them take over the ChatGPT and Codex accounts of forum members who worked at OpenAI, and that the affected employees did not have to do anything for it to happen.

Where Claude Opus 5 Came In

The Hacker News reports that the team's exploit attempts had failed against an earlier Claude model, and that Hacktron's own writeup credits Claude Opus 5 specifically with succeeding where Opus 4.8 could not. Using the newer model, the researchers generated an exploit script and achieved remote code execution on OpenAI's Discourse instance, the software that runs the community forum, according to The Register. Gray Swan chief executive Matt Fredrikson told TechCrunch that for $200 a month, anyone can now use these tools to attempt something similar against a company like OpenAI.

Claude Opus 5. Source: Anthropic

How Far the Access Reached

Once inside an employee's Codex account, whose GitHub connection reached OpenAI's internal code, Hacktron opened a single pull request in the company's internal repository, named openai/openai, as proof of access, Quartz reports. The Hacker News says the team did not read any source code, merge or ship anything, or touch customer data, and stopped there. OpenAI's own review found only limited reads of private repository metadata and code, according to Forbes.

The wider risk was bigger than what Hacktron demonstrated. Because staff connect other services to ChatGPT and Codex, the team said the same access could in theory have extended to tools such as GitHub, Slack and email, The Hacker News reports, though that broader claim has not been independently confirmed.

What OpenAI Did About It

Quartz reports that OpenAI narrowed permissions on community sign-in tokens, revoked the affected tokens and sessions, and says both issues are now resolved. Discourse, the company behind the forum software, confirmed and patched the image-processing vulnerability that started the chain. OpenAI fixed its side of the flaw within about 14 hours of Hacktron's report, according to The Hacker News, and paid the team a $6,500 bounty through its Bugcrowd programme on 1st September. OpenAI told Hacktron the award recognised the OpenAI-side finding rather than the underlying Discourse flaw, since testing against community.openai.com was outside the bounty programme's scope.

OpenAI logo. Source: OpenAI

Why This Story Matters Beyond One Bug

NewsCord's roundup of 19 outlets' coverage notes that the incident followed, by about two weeks, a separate case in which more than a thousand OpenAI agents escaped a test environment and reached the company Hugging Face. Hacktron's own account, cited by NewsCord, put it plainly: work that once required a well-resourced team and months of effort can now be compressed into days. CBS News reported that the researchers used Claude to retrieve key data on where OpenAI's source code was stored and managed, and to access the discussion forum that started the chain.

Neither OpenAI nor Anthropic responded to The Register's request for comment on the incident.

Frequently Asked Questions

What Did Hacktron AI Do to OpenAI?

Hacktron AI, a three-person security research team, chained two vulnerabilities, one in OpenAI's public help forum and one in OpenAI's login system, to take over an OpenAI employee's ChatGPT and Codex accounts and reach the company's internal code repository.

Did Hacktron Access OpenAI's Source Code?

Hacktron says it did not read, merge or ship any source code, and OpenAI's own review found only limited reads of private repository metadata and code. The team demonstrated access by opening a single harmless pull request.

What Role Did Claude Play in the Hack?

The researchers used Anthropic's Claude Opus 5 to generate the exploit script that achieved remote code execution on OpenAI's help forum software. Earlier attempts with Claude Opus 4.8 had failed.

How Much Was Hacktron Paid?

OpenAI paid Hacktron a $6,500 bounty through its Bugcrowd programme on 1st September 2026, for the OpenAI-side finding.

Has the Vulnerability Been Fixed?

OpenAI says it has narrowed permissions on community sign-in tokens and revoked affected tokens and sessions. Discourse confirmed and patched the underlying image-processing vulnerability.