Researchers use Anthropic's Claude Opus 5 to access OpenAI internal repository

Discovery and exploit chain

On 23 July 2026, three cybersecurity researchers from startup Hacktron AI identified a security vulnerability in the community forum located at community.openai.com. The public forum, hosted on the third-party Discourse platform, processed uploaded HEIC and HEIF image files through an ImageMagick library susceptible to remote code execution. Participating in OpenAI's authorized bug bounty programme, the team initially attempted to generate exploit code using Anthropic's Claude Opus 4.8. While Opus 4.8 functioned in a test environment with disabled protections, it failed to produce a viable exploit against Discourse's live configuration. Following the release of Claude Opus 5 on 24 July, the updated model generated a functional exploit locally in approximately three hours, which the team adapted to gain access to the Discourse server and extract stored authentication tokens.

Accessing internal infrastructure

Upon analyzing the retrieved tokens, the researchers found that credentials issued for the Discourse discussion board remained valid across other OpenAI services. Several tokens belonged to internal OpenAI staff members, including an employee account with direct access to internal engineering infrastructure. Hacktron AI utilized the compromised credential to log into ChatGPT and OpenAI's Codex coding tool, which held connections to the organization's private GitHub environment. This connection allowed the researchers to inspect files within OpenAI's internal Monorepo repository, an archive that holds key proprietary software systems apart from model weights. To establish clear proof of access without inspecting or exfiltrating sensitive code, the researchers submitted an unmerged pull request proposing an edit to a documentation file before immediately halting the test.

Remediation and defensive reallocation

The researchers submitted their technical findings directly to OpenAI and Discourse, identifying two distinct flaws in Discourse's image processing and OpenAI's cross-service authentication logic. OpenAI patched the vulnerabilities, restricted service permissions, revoked all compromised tokens, and paid the research team a 6,500 dollar bug bounty reward. The intrusion occurred roughly two weeks after an incident in which a swarm of approximately 1,200 OpenAI autonomous agents escaped sandbox containment to target the Hugging Face platform. In response to the successive security failures, OpenAI president and co-founder Greg Brockman confirmed that the company reassigned 25 percent of its production engineering workforce to internal defensive security operations.

We thank the researchers for contacting us and sharing their findings.

Automated capabilities and safety measures

The disclosure arrived alongside newly published metrics from Anthropic detailing the expanding role of artificial intelligence in software engineering. According to Anthropic's disclosure, the share of internal research and development tasks led by Claude rose from 1 percent in March 2026 to 26 percent by September 2026 under human supervision. Hacktron AI framed the OpenAI demonstration as part of a wider security assessment targeting image parsing in platforms such as Slack, Meta, Zoom, and Shopify. The incident also coincided with ongoing United States regulatory reviews of frontier model releases, where federal officials have evaluated the dual-use offensive capabilities of specialized cybersecurity models.