Security researchers breach OpenAI internal systems using Anthropic Claude Opus 5

Vulnerability in community infrastructure

A three-person cybersecurity team at startup Hacktron AI penetrated OpenAI's internal systems during a 72-hour ethical hacking exercise in July 2026. The intrusion began on 23 July when researchers discovered an image-processing flaw in the Discourse discussion platform hosting OpenAI's public community forum. Discourse relies on FastImage for file validation, but passes unsupported.heif,.heic, and.avif image files to ImageMagick for conversion. This routine exposed an unpatched heap buffer overflow in the underlying libheif library, a component also deployed across platforms such as Slack, Meta, and GitHub Enterprise. Hacktron initially attempted to generate exploit code using a specialized version of Anthropic's Claude Opus 4.8 provided to qualified cybersecurity practitioners. The earlier model struggled over multiple sessions and failed to generate a working remote code execution payload.

Automated code generation with Opus 5

The operation advanced rapidly following Anthropic's release of Claude Opus 5 on the night of 23 July. Researchers configured the new model to operate as an automated agent in a loop against a local Discourse Cloud instance, successfully producing a functional remote code execution exploit with only a few hours of direct human guidance. Applying this code against OpenAI's live community forum allowed the team to compromise the underlying server and harvest internal session access tokens. Hacktron chief technology officer Mohan Pedhapati stated that commercial AI models substantially lowered the technical barrier required to execute complex network attacks.

“I do not think we are as good as Chinese threat actors. We are just three guys with subscriptions to Claude and Codex.”

Escalation to internal code repositories

Using the captured tokens, the researchers identified a secondary vulnerability stemming from a single sign-on misconfiguration in OpenAI's identity infrastructure. This flaw permitted the team to hijack employee ChatGPT accounts, including associated OpenAI Codex accounts. One compromised employee account retained active authorization to OpenAI's internal GitHub repository, granting access to the company's Monorepo codebase containing proprietary algorithm designs. To verify access without inspecting or copying sensitive code, Hacktron used the employee's Codex interface to submit a harmless pull request before halting testing. The researchers also confirmed that they utilized OpenAI's own GPT-5.6 Sol model alongside Claude at various stages of the penetration.

“Work that once required a well-resourced team and months of effort can now be compressed into days.”

Disclosure and vendor remediation

Hacktron submitted its findings directly to OpenAI and Discourse on 25 July under OpenAI's official bug bounty programme. OpenAI patched the identity misconfiguration, secured the Discourse forum integration, and awarded Hacktron a $6,500 bounty (approximately €5,700) for the responsible disclosure. An OpenAI spokesperson confirmed that the vulnerabilities had been resolved and thanked the researchers for sharing their data. The incident emerged alongside other safety disclosures from OpenAI, which recently reported six examples of unexpected model behaviour and a July incident involving autonomous agent swarms breaching systems at AI startup Hugging Face.