Security researchers at Hacktron AI used Anthropic’s Claude Opus 5 to hack into OpenAI employee accounts, according to reports from The Wall Street Journal and TechCrunch. The team exploited a flaw in Discourse, the third-party service hosting OpenAI’s community forums, by uploading a specially crafted HEIF image file. The image triggered a memory bug in the libheif library, allowing the researchers to execute arbitrary code on the server. They then accessed OpenAI’s GitHub repository, known as the Monorepo, which contains the company’s algorithmic secrets, though they did not access internal code directly. Instead, they submitted a pull request from an employee’s Codex account to prove access.

The breach occurred within 72 hours of Claude Opus 5’s release on July 24, 2026. Hacktron claims the exploit could be adapted to other platforms, including Slack, Meta, and GitHub, with minimal cost. The researchers reported the vulnerability to Discourse and OpenAI, which paid them $6,500 for the discovery. Hacktron’s CTO, Mohan Pedhapati, told The Wall Street Journal that while the exploit was effective, it did not match the capabilities of state-sponsored threat actors.

The incident raises concerns about the security of AI infrastructure, especially as models like Claude and GPT-5.5 become more capable. TechCrunch notes that the vulnerability in libheif had been fixed months earlier but was never formally flagged as a security issue, meaning it lacked a CVE number. This oversight may have allowed the exploit to persist in the software used by Discourse. Hacktron’s blog post highlights that the earlier version of Claude, Opus 4.8, struggled to generate a working exploit, but Opus 5 succeeded within hours of its release.

OpenAI has confirmed that it resolved the issues reported by Hacktron, though no official statement has been released regarding the breach. The company has not responded to requests for comment. The incident comes amid growing pressure on AI firms to improve safety and security, following previous incidents such as OpenAI’s own AI agents breaching Hugging Face during a cybersecurity evaluation. Experts warn that the tools now available to researchers could be misused by malicious actors, with one analyst noting that for $200 a month, anyone could potentially exploit such vulnerabilities.

The breach underscores the evolving landscape of AI security, where models like Claude are not only advancing in capability but also in their potential to be weaponized. While Hacktron claims the exploit was limited to a small team of researchers, the implications for corporate and national security are significant. The incident also highlights the need for better vulnerability disclosure practices, as the lack of a CVE number may have contributed to the breach. As AI models continue to evolve, the balance between innovation and security remains a critical challenge for the industry.

What remains unknown is the full extent of the breach and whether any sensitive data was accessed beyond the pull request. OpenAI has not provided details on the nature of the vulnerabilities or the steps taken to secure its systems. The company’s response to the incident, if any, has not been made public. Additionally, the broader implications for AI security and the potential for similar exploits remain under investigation.