Three Hackers Used Claude to Break Into OpenAI In Less Than 72 Hours

The July Hugging Face Hack—in which thousands of OpenAI agents secretly escaped their testing environment, formed a “ collective ,” and gained access to the open internet—revealed just how vulnerable companies’ cyber defenses are in the face of modern AI systems. As it turns out, that includes the very companies building the technology.

On July 25, less than 10 days after Hugging Face announced it had been hacked, a trio of independent cybersecurity researchers operating under the alias Hacktron broke into the ChatGPT and Codex accounts of multiple OpenAI employees, giving them a potential pathway to a cache of highly sensitive company information. Luckily for OpenAI, the researchers—Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini—were looking for vulnerabilities as part of the company’s bug bounty program. After disclosing the breach to OpenAI contacts on X, they were paid a whopping $6,500.

But the hackers used vulnerabilities that could easily have been discovered and exploited first by someone with much less friendly intentions.

Two days earlier, Hacktron had discovered a security flaw in the image-upload software used by Discourse, the online discussion platform OpenAI uses internally. Using Anthropic’s Claude Opus 4.8, they began by trying to generate code that would allow them to upload malicious files that would act as a digital Trojan horse, through which they could gain private access to discussions hosted on the site. ( According to the Wall Street Journal , they had been using a non-public version of Opus 4.8 given only to qualified cybersecurity researchers.)

They were unsuccessful at first. But Anthropic released Opus 5 the following day, and that model fared much better. Early in the morning of July 25, the hackers discovered Opus 5 had successfully exploited the Discourse bug and that they were able to view an internal OpenAI discussion forum containing employees’ authentication tokens—unique digital codes enabling access to apps or websites—that could be used to access employees’ ChatGPT and Codex accounts. They could’ve gone even deeper from there: “the scope of what we could theoretically access was huge, including GitHub, Slack and emails,” the Hacktron researchers wrote in a report about the hack published on Sunday.

Within an OpenAI employee’s Codex account, the Hacktron team submitted a pull request (or “PR”) to prove they had been there without retrieving any sensitive company data: the digital equivalent of planting a flag on a mountaintop.

“The entire timeline from initial discovery to access to OpenAI repo access took place in less than 72 hours,” Hacktron notes in its report. “This was not completely autonomous hacking, and skilled human guidance remained important, but the amount of work a small team could perform increased dramatically.”

Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc.

We proved it with a PR in OpenAI’s internal codebase . It took us <72h.