IA · 18 September 2026 · 4 min read
Three Researchers, Claude, and 72 Hours: How OpenAI Was Breached by Rival AI
In brief: A three-person cybersecurity team from startup Hacktron AI utilized Anthropic's Claude models to breach OpenAI's internal systems in under 72 hours. By exploiting a native image parsing vulnerability within the third-party Discourse forum software, the researchers moved laterally to hijack employee accounts and access OpenAI's core GitHub 'Monorepo'. The ethical disclosure, rewarded with a $6,500 bounty, highlights how commercial frontier AI drastically compresses the cost and timeline required to uncover and weaponize zero-day vulnerabilities.
by Team Mocchi's
An Algorithmic Incursion into OpenAI's Stronghold
In the ongoing race for artificial intelligence supremacy, technological irony has reached a notable milestone. A small group of three security analysts from cybersecurity startup Hacktron AI managed to penetrate OpenAI's perimeter defenses using the flagship model of its primary rival, Anthropic's Claude. Carried out as part of OpenAI's official bug bounty program, the ethical operation took less than 72 hours and consumed under $3,000 in API tokens.
As reported by The Verge, the researchers leveraged the advanced reasoning and code analysis capabilities of Claude Opus to chain together complex software flaws. The intrusion ultimately reached OpenAI employee accounts and came within striking distance of the "Monorepo", the company's proprietary GitHub repository containing its algorithmic designs and core codebase.
HEIF Heist: The Flaw in Discourse's Image Parsers
The initial point of entry was not a frontal attack on frontier neural weights or high-performance GPU clusters, but a classic third-party supply chain dependency: Discourse, the SaaS platform hosting OpenAI's public community forums. Dubbed "HEIF Heist" by the researchers, the campaign zeroed in on low-level C and C++ components responsible for decoding modern media formats like HEIF and AVIF.
Beneath typical web application layers sit legacy native libraries such as libheif, frequently pulled in through processing engines like ImageMagick or Sharp. By uploading deliberately crafted image files to the community boards, the team triggered a memory corruption flaw that led to remote code execution (RCE) on Discourse Cloud. Claude assisted the researchers in analyzing crash dumps in real time, determining dependency versions, and constructing functional exploit payloads within hours.
Moving Laterally to Internal Repositories
Having established code execution within the forum environment, the researchers pivoted inward. As detailed by Ars Technica, the team intercepted session tokens and single-sign-on credentials, gaining control of an OpenAI employee's ChatGPT and developer access profiles. The compromised account had privileged connections to internal development tools and Codex environments.
To demonstrate the validity of the compromise without exfiltrating confidential intellectual property, the team halted before downloading proprietary code. Instead, they submitted an unauthorized pull request from the employee's account as proof of concept. OpenAI acknowledged the disclosure, resolved the affected configurations, and awarded Hacktron $6,500 under its responsible disclosure framework.
The Commercial AI Offense Asymmetry
The ramifications extend far beyond OpenAI. Hacktron revealed that the identical technique was rapidly ported within one to two days against other prominent platforms, including Meta, Slack, and GitHub Enterprise—with only Shopify detecting the activity in real time.
According to reporting from TechCrunch, cybersecurity analysts emphasize that offensive research that previously demanded nation-state budgets can now be automated by small teams using commercially accessible models. As Hacktron CTO Mohan Pedhapati observed, the team did not possess state-sponsored infrastructure, but rather "three guys with Claude and Codex subscriptions." When accessible AI tools can pierce the defenses of heavily secured tech leaders, traditional perimeter security models are fundamentally challenged.
Mocchi's take
This incident illustrates that modern application resilience is determined not merely by the cleanliness of custom internal code, but by the integrity of the broader supply chain and supporting SaaS integrations. For organizations building and operating digital infrastructure, the ability of AI agents to rapidly map and exploit low-level library flaws makes zero-trust isolation mandatory across all peripheral services. An auxiliary forum or media processing pipeline can no longer be treated as low-risk when automated reasoning models make lateral movement swift and accessible.