Three researchers used Anthropic’s Claude to breach OpenAI’s internal systems in under 72 hours.
The attack exploited OpenAI’s community forum to gain access to employee ChatGPT and Codex accounts. From there, the intruders reached the company’s internal code repository on GitHub. The entire operation became possible only after OpenAI shipped Claude Opus 5.
How the breach happened
The team behind the attack, known as Hacktron, combined two separate flaws to move through the network. The first was an outdated image library. The forum used libheif to process uploaded HEIC images. A fix for a known issue had existed in the original source code for a year, but it was never flagged as a security problem. Debian packages running on the forum still lacked the patch. A specially crafted image file allowed the researchers to run their own code on the server.
The second flaw was a misconfiguration in OpenAI’s central single sign-on system. Anyone controlling the forum server could impersonate active members and take over their accounts. The issue extended beyond the forum itself. Any service using OpenAI login would have granted the same access if compromised. To prove they had access, the researchers used an employee’s Codex account to create a harmless pull request in the internal monorepo. They stated they did not view any sensitive data.
The attack ran through community.openai.com. Any user or employee who used “Sign in with OpenAI” there was potentially affected. Users can connect GitHub, Slack, and email to Codex and ChatGPT, so the attack could theoretically have reached those services too.
OpenAI confirmed the fix about 14 hours after the report. Discourse, the software behind the forum, also responded within days.
Why Opus 5 worked when Opus 4.8 failed
The researchers initially used Claude Opus 4.8 to find the vulnerability. The model built a working exploit but only with ASLR, a common defense against memory attacks, disabled. Across several sessions, it could not produce a reliable version with ASLR enabled.
On the evening of July 24, Anthropic released Claude Opus 5. The new model produced a working exploit for a local Mac within three hours, then adapted it to the Discourse server environment. The researchers ran Claude in an autonomous loop against their own test instance.
Because the model refused to write exploits against real systems, they presented the target as a benchmark task. Four hours later, the agent had taken over the server. On a related task, the researchers also observed a jump in performance compared to OpenAI’s GPT-5.6 Sol.
AI lowers the cost of cyberattacks
Beyond the OpenAI hack, the researchers expanded their investigation, dubbed “HEIF Heist”, to cover Slack, Meta, GitHub Enterprise, and other targets. Three people carried out the project over two months, spending less than $3,000 on AI. Adapting the attack to each new target took just one to two days. Only Shopify noticed the activity, despite thousands of image uploads and repeated crashes in image processing.
Software has long benefited from a kind of security through complexity. Even with public source code and a known vulnerability, building a reliable exploit required rare expertise, time, and deep knowledge of the target environment. Complexity was not a true security barrier, but it did protect many companies in practice.
AI strips away that protection by replacing scarce expertise with computing power. Hacktron argues that threat models must reflect how cheap attacks have become. Work that once required a well-resourced team and months of effort can now be compressed into days.
What it means
The incident shows how quickly the barrier to entry for sophisticated breaches has fallen. Tools that once required deep specialist knowledge are now accessible through general-purpose models. For companies, this means relying on complexity alone is no longer a safe strategy. Fixes must be applied faster, and authentication systems need to be hardened against impersonation attempts.
