Hacktron Used Claude to Reach OpenAI Internal Monorepo in 72 Hours
In July 2026 a three-person Hacktron AI team used Claude Opus models to reach OpenAI internal source control in under 72 hours via the community forum and SSO. OpenAI paid a $6,500 bounty on 1 September 2026 and said the OpenAI-side issues were fixed about 14 hours after the Bugcrowd report.
Disclosure
On 18 September 2026, Electrovolt Security and Hacktron AI founder Mohan Pedhapati (s1r1us) said a three-person team had reached OpenAI internal source control in July 2026 in under 72 hours, using Anthropic Claude Opus. The other researchers were security research lead Harsh Jaiswal and researcher Rahul Maini.
https://x.com/S1r1u5_/status/2100777801335095383
A write-up titled "Hacking OpenAI" had been on Hacktron's blog since 13 September 2026. A Wall Street Journal exclusive, "Hackers Used Anthropic's Claude to Break Into OpenAI," and Pedhapati's thread drove the later spike. The thread passed 550,000 views within hours and ranked high on Hacker News.
https://www.hacktron.ai/blog/hacking-openai
Versions and flaws
community.openai.com runs Discourse. Discourse used FastImage for image checks. FastImage does not support HEIF, so HEIC uploads were passed to ImageMagick's magick command and parsed by libheif.
The team began reviewing that path on 23 July 2026 and identified a heap buffer overflow in libheif. Upstream had changed related code the year before without marking a security fix or assigning a CVE, so Debian 12 and Debian 13 missed a timely backport. The Discourse Docker image is based on Debian 12 and shipped libheif 1.19.7. Debian 13 still carried affected 1.19.8. Debian shipped a Debian 13 security update on 8 August 2026.
OpenAI also allowed forum login through auth.openai.com "Sign in with OpenAI." A configuration issue allowed a compromised forum to become takeover of ChatGPT and Codex accounts for users who had signed in that way, including OpenAI staff. Hacktron said any compromised first-party or third-party service using OpenAI SSO would have the same effect. Those accounts are often linked to Outlook, Gmail, Google Drive, Slack, and GitHub.
Proof and fix
Without reading sensitive content, the team used a staff Codex account already connected to OpenAI's GitHub organization to open a harmless pull request on the internal monorepo openai/openai, then stopped.
The Wall Street Journal, citing people familiar with the matter, said the monorepo stores algorithm material for faster, more efficient models, not model weights. The change was a documentation file containing "Hacktron AI Team PoC" and two researchers' X links. It was not accepted.
On 25 July 2026 (UTC): forum administrator access between 05:00 and 06:00; Bugcrowd report between 08:00 and 10:00; staff account takeover and the proof request between 13:30 and 15:30, with a warning to OpenAI contacts on X and a stop around 15:30; OpenAI confirmation at 22:49 that the issue was fixed, about 14 hours after the first report.
The Discourse report went through HackerOne (sent Saturday, reply Sunday, fix Monday). Advisory GHSA-vhm9-85gw-x335 was published on 28 July 2026. Discourse also sandboxed ImageMagick.
Claude use, bounty, and follow-on
Hacktron said Claude Opus 4.8 inspected the Discourse Docker image and flagged libheif fixes that had not been backported. After Claude Opus 5 shipped that evening, work continued with the new model. The team said skilled human direction remained essential. It also reported a further jump in blind, unknown-target tests from Opus 5 to GPT-5.6 Sol.
The OpenAI and Discourse work took days of agent time and hours of human time. The broader HEIF Heist project against firms including Slack, Zoom, and Meta lasted two months, involved three researchers, and cost under $3,000 in tokens. Adapting to a new company usually took one or two days. Except for Shopify, Hacktron said no tested company appeared to detect the activity.
On 1 September 2026 OpenAI paid $6,500 and marked the report resolved. It noted that tests against Discourse-hosted community.openai.com were explicitly out of bounty scope, and that the award recognized OpenAI-side findings, not Discourse-targeted work.
Joshua Saxe reviewed the technical report before publication at the request of the Wall Street Journal and s1r1us. He asked how many stronger actors may already have entered and taken algorithm secrets, weights, or user data, whether implants remain inside frontier-lab networks, and how common this class of weakness is. He also questioned the public-safety return of Anthropic cyber safety controls if they add friction for defenders while attackers can avoid them.
https://x.com/joshua_saxe/status/2100775309012296171
Other 2026 OpenAI-linked events include a July ExploitGym isolation failure involving GPT-5.6 Sol and an unpublished internal model that reached Hugging Face production; a May test-agent upload of more than 500 malicious RubyGems packages, reported on 11 September by Spencer Kitts, Thomas Larsen, and Sydney Von Arx (registration paused, then restored on 16 May); and about 18,000 wiki-farm posts from agents claiming to be OpenAI systems. On 5 September OpenAI said it would publish a framework for disclosing misalignment incidents and that it was in contact with dozens of regulators.
The Claude report spread on the same day OpenAI disclosed six anomalous model behaviors since March.
Hacktron argued that the industry has relied on complexity as practical protection: even known bugs required scarce skill and time to exploit, which kept ordinary firms safer. It said AI is turning that scarce skill into compute and removing that barrier.