A small team of security researchers just used Anthropic’s Claude to break into OpenAI employee accounts, and it took them less than three days. According to The Verge AI, which cites reporting from The Wall Street Journal, the three independent researchers at a firm called Hacktron pulled it off using Claude Opus 4.8 and 5. This is one of the clearest real-world signs yet that frontier AI models can now drive offensive hacking, not just help write code.
What stands out here is how fast and how cheap it was.
What happened
The Hacktron team got into OpenAI’s systems by targeting Discourse, the third-party service that runs OpenAI’s community forums. They exploited a flaw in how the system processes HEIF images, the format Apple devices use for photos. That single weakness gave them a path in.
Once inside, they reached OpenAI’s GitHub repository known as “Monorepo,” which The Wall Street Journal’s sources describe as holding “OpenAI’s algorithmic secrets.” The researchers didn’t read the internal code. Instead, they sent a pull request from an employee’s Codex account to prove they had access, then stopped.
The timeline is the part worth sitting with. Per The Verge AI’s account, Claude Opus 5 launched on the evening of July 24th. By 10AM the next morning, the team had used it to achieve remote code execution on Discourse Cloud and reach OpenAI’s instance. That’s roughly overnight.
Why this matters
Hacktron didn’t build a one-off exploit. They built a reusable attack, nicknamed the “HEIF Heist,” and adapted it across a long list of major targets:
- OpenAI
- Slack
- Meta
- GitHub Enterprise
- Rails
- Next.js
- ImageMagick
Adapting the attack to each new company took “only one or two days,” the team says, and the whole effort ran on less than $3,000 in AI tokens. To their knowledge, only one target, Shopify, actually detected them.
Sit with those numbers. A near-industrial hacking campaign against some of the biggest names in tech, run by three people, for the price of a used car. The old assumption was that this kind of coordinated, multi-target intrusion required a well-funded team or a nation-state operation. That assumption is now weaker.
The status quo just shifted
For years, AI labs have talked about “dual use” risk in the abstract. The same model that finds a bug so it can be fixed can also find a bug so it can be exploited. This is that risk showing up in the wild, with named companies and a real intrusion.
The good news, if you want to call it that: this was security research, not a criminal breach. The vulnerabilities Hacktron reported to Discourse and OpenAI have since been fixed, and OpenAI paid the team $6,500 through its bug bounty program for the find. That’s a fraction of what the access could have been worth to a bad actor.
Hacktron’s CTO, Mohan Pedhapati, put the stakes plainly to the WSJ: “I don’t think we are as strong as Chinese threat actors. We’re just three guys with Claude and Codex subscriptions.” Read that as a warning. If three researchers with consumer subscriptions can do this, better-resourced attackers can do more.
What to expect next
A few things practitioners should watch:
- Faster patch cycles. Expect more pressure on third-party services like Discourse, since the weak link here was a vendor, not OpenAI’s own code.
- Bigger bounties. A $6,500 payout for access to “algorithmic secrets” looks low. Bounty programs may need to reprice as AI lowers the cost of finding serious bugs.
- AI-driven defense. The same models now speeding up attacks will get pointed at defense, scanning code and dependencies before attackers do.
- More scrutiny on model access. Labs will face fresh questions about what their models help users do, and how to spot offensive use.
The takeaway is simple. The barrier to serious offensive security work just dropped, and it dropped fast. If you run infrastructure, assume attackers now have the same tools you do, and that they’re moving quicker than before.
For the full breakdown, including the technical specifics, check the original report at The Verge AI.