Three researchers used Claude to reach OpenAI's internal code

Security startup Hacktron AI has published how its three-person team took over the ChatGPT and Codex accounts of several OpenAI employees. From one employee's GitHub-connected Codex account they opened a harmless pull request in OpenAI's internal monorepo as proof of access, then stopped.

The whole chain took under 72 hours and under $3,000 in tokens. It joined two flaws: a memory bug in the libheif image library, reached through image uploads to OpenAI's community forum, and a misconfiguration in OpenAI's single sign-on.

Before and after

Claude Opus 4.8 failed to produce a reliable exploit over several sessions. Within hours of Anthropic shipping Opus 5, the same problem was solved. People directed the attack throughout; it wasn't an autonomous ai attack. OpenAI paid a $6,500 bounty for the sign-on finding.

Why it matters

A model compressed a real attack from weeks into a long weekend. But the way in was a trust problem. The image bug had been fixed upstream a year earlier without being flagged as a security issue, so it never got a CVE and stayed in shipped forum software. Hacktron says the same weakness turned up in Slack, Meta's products, GitHub Enterprise, Rails and Next.js, and only Shopify noticed its probing. The lock was fine. The keys were lying around.