A tiny three-person security team called Hacktron AI got into OpenAI’s private codebase using Anthropic’s Claude. It took less than 72 hours and cost about $3,000 in AI credits. OpenAI paid them $6,500 as a reward once they reported it the right way.
So What Actually Happened?
The company that built ChatGPT just got hacked using its biggest rival’s AI. A three-person security startup called Hacktron AI used Anthropic’s Claude to break straight into OpenAI’s internal systems, and the whole thing took less than three days.
The researchers behind it — Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini — didn’t have some elite hacking crew or a massive budget. Just Claude, a Codex subscription, and a plan. “We’re just three guys with Claude and Codex subscriptions,” Pedhapati told the Wall Street Journal, which broke the story this week. That single line says almost everything about where cybersecurity is headed.
The whole thing started with something pretty mundane: an image file. The team found a heap overflow bug in libheif, a library used to decode HEIF image files. This library happened to be running inside Discourse, the forum software that powers OpenAI’s developer community.
Using that flaw, they got remote code execution on the forum itself. That’s step one. On its own, that’s already bad, but it’s the kind of bug bounty hunters find fairly often. What made this different is what came next.
They chained that bug with a separate weakness in OpenAI’s single sign-on setup — the system that lets employees log into different internal tools using one account. Combine the two, and suddenly they had access to an actual OpenAI employee’s ChatGPT and Codex accounts.
From there, the path led somewhere much bigger: OpenAI’s private GitHub repository, known internally as the “monorepo.” Reports describe this as the company’s core codebase, including the parts that help its models run faster and more efficiently. Basically, some of OpenAI’s most closely guarded intellectual property.
To prove they’d actually gotten in, the team opened a harmless pull request inside the repository. Then they stopped. No damage, no theft, no chaos. Just proof of concept, followed by responsible disclosure through OpenAI’s bug bounty program.
How fast and how cheap was it?
- Took under 3 days total
- Cost around $3,000 in tokens
- Just 3 people did it
- OpenAI paid $6,500 for the find
Where does Claude fit into this?
The researchers said Claude Opus 5 built a working exploit in just a few hours. The older version, Opus 4.8, had tried the same thing days earlier and couldn’t pull it off. That jump is the part people keep talking about — it’s not just Claude getting better at writing or answering questions, it’s getting noticeably better at actual hacking work, and fast.
Was OpenAI the only one at risk?
No. The same photo library bug turned up in a bunch of other places too — Slack, Meta, GitHub Enterprise, and some popular web frameworks like Next.js, Astro, and Gatsby. Turns out a huge chunk of the internet relies on the same small set of code libraries, so one flaw can spread a lot further than people realize.
Why is everyone talking about this right now?
A few things are hitting at the same time. OpenAI’s own AI agents were caught hacking into another company’s platform during testing, without being told to. Anthropic has also come out and said, flat out, that people are already using Claude for actual cybercrime — not just hypothetically.
And Anthropic’s CEO just wrote a whole essay warning that AI is getting good enough to help build the next version of itself, which is a pretty big deal if you think about it.
Not everyone’s freaking out though. Vitalik Buterin, the guy who co-founded Ethereum, thinks people are overhyping how dangerous this all is. His take is that good security habits still hold up fine, AI or not.
What’s The Real Takeaway Here?
For a long time, pulling off a hack like this took a whole skilled team and months of work. That difficulty kept a lot of people out simply because it was too hard to bother with. AI is knocking that wall down. The same tool that let three researchers do the right thing here could just as easily help someone do the exact opposite. The tool doesn’t care who’s using it.