Researchers hacked OpenAI using Claude to exploit image-processing flaw

Three independent security researchers demonstrated a significant breach into OpenAI's infrastructure, gaining unauthorized access to employee accounts and the company's primary code repository in less than three days. The attack, detailed by Hacktron, relied on Anthropic's Claude AI model to help identify and exploit security weaknesses.

How the breach unfolded#

The researchers exploited a vulnerability in Discourse, the third-party service powering OpenAI's community forums. Specifically, they targeted a flaw in how the system processes HEIF image files. Within hours of Claude Opus 5's release on July 24th, the team achieved remote code execution (RCE) on Discourse Cloud and gained access to OpenAI's instance. To prove their access, they submitted a pull request using a compromised employee account rather than accessing the internal code themselves.

Scope and impact#

The breach gave researchers access to OpenAI's "Monorepo," a GitHub repository that reportedly houses core algorithmic secrets and proprietary code. OpenAI has since patched the vulnerability, and the researchers disclosed their findings through responsible disclosure channels.

Broader campaign#

The HEIF Heist project showed how quickly similar vulnerabilities could be weaponized across organizations. In parallel campaigns taking only one to two days of adaptation work per target, the researchers successfully penetrated systems at Slack, Meta, GitHub Enterprise, Rails, Next.js, ImageMagick, and others—spending less than $3,000 in API tokens across all efforts. Remarkably, only Shopify detected the intrusion.

Response and resolution#

OpenAI awarded Hacktron $6,500 as a bug bounty for the discovery. CTO Mohan Pedhapati told the Wall Street Journal that the team's modest resources—"just three guys with Claude and Codex subscriptions"—underscored how accessible powerful attack tools have become.