Harsh Jaiswal, Mohan Pedhapati and Rahul Maini had access to Anthropic’s Claude and a route into OpenAI’s systems. The three researchers, who make up the security startup Hacktron AI, used the AI assistant to develop an exploit chain that reached an OpenAI employee’s ChatGPT account and the company’s internal software repository, they said.
The researchers reported the findings to OpenAI in July. OpenAI paid Hacktron AI $6,500 through its Bugcrowd bug bounty programme, then narrowed permissions on community sign-in tokens and revoked affected tokens and sessions. The incident was publicly disclosed on 18 September 2026, after The Wall Street Journal first reported it.
“We're just three guys with Claude and Codex subscriptions,” Pedhapati said. The episode offers a clear example of how an advanced AI system can assist security research against the infrastructure of a rival AI company. It also leaves unanswered questions about what information might have been available had the access lasted longer, and whether others had identified similar flaws.
The initial entry point was community.openai.com, an OpenAI forum that uses the Discourse software. HEIC and HEIF image uploads to Discourse passed through ImageMagick and were decoded with libheif. That library had a heap buffer overflow vulnerability, a flaw involving the way a program handles memory.
Hacktron first used Claude Opus 4.8 to investigate the weakness and build an exploit. Address-space layout randomization, a protection that varies where programs keep data in memory, prevented the model from generating a reliable attack. Anthropic released Claude Opus 5 on July 24. After moving to the newer model, Hacktron created a working exploit within hours, according to the researchers.
The entire route from the initial discovery to access took less than 72 hours. That route involved a second weakness: session tokens issued by the forum continued to work for ChatGPT and Codex. Such tokens act as credentials that keep users signed in. Some belonged to OpenAI employees.
Using those credentials, the researchers discovered part of OpenAI’s source code called “Monorepo”. Sources told the WSJ that Monorepo is the company’s “secret sauce” that makes its models operate faster. OpenAI said it found limited reads of private-repository metadata and code.
The available account does not establish whether Claude Opus 5 was deliberately improved for security research or whether the outcome was an incidental effect of the upgrade. It is also unclear whether Anthropic knew Claude was being used in the research before the attack, or the full extent of material that could have been reached through the vulnerability chain.
OpenAI president Greg Brockman said the company had redirected 25% of its production engineers to security work after two incidents. He did not specify the nature of those incidents in the information available. OpenAI has not disclosed a complete timetable for its remediation work or any further measures beyond restricting the community sign-in tokens and invalidating the affected sessions.
OpenAI and Anthropic have each called for safety guardrails that would allow AI development to proceed at a pace where people can review models’ security-threat capabilities before public release. Hacktron’s work illustrates the difficulty in drawing that line. A small team was able to use a commercially available model to turn a forum flaw and an authentication failure into access to one of the industry’s most closely held software environments.
Comments (0)