CYBERSECURITY & PRIVACY · INCIDENT EXPLAINER

Security researchers at Hacktron used Anthropic’s Claude during an authorized bug-bounty investigation that reached OpenAI employee ChatGPT and Codex accounts and an internal code repository. The bigger story is not “AI hacked OpenAI” on its own—it is how AI can compress exploit work while old dependencies and broad identity trust expand the blast radius.

Published September 21, 2026 · Research-based security explainer · About 13 minutes

AI-assisted security research context. Photo: Jefferson Santos / Unsplash (Unsplash License). Illustrative; not an OpenAI incident screenshot.

At a glance

Quick answer: This was good-faith security research, not a known criminal breach. Public reporting says a three-person Hacktron team used Claude Opus 5 to help develop an exploit for a vulnerability in software behind OpenAI’s public community forum, then chained that foothold with a separate OpenAI login weakness. The researchers reported the issues, stopped after demonstrating access with a harmless pull request, and received a $6,500 OpenAI bounty.

• July 24: Anthropic released Claude Opus 5.
• July 25: Hacktron’s reported investigation found a path into the Discourse-based OpenAI forum.
• July 27: Discourse shipped a fix after notification, according to reporting on the researchers’ account.
• September 1: OpenAI paid the $6,500 bounty for the OpenAI-side finding.
• September 18–19: the research became broadly public through news coverage.

Important limitation: the sources reviewed do not report a mass compromise of ChatGPT customers, theft of OpenAI source code, or an autonomous Claude system independently choosing and executing the operation.

In this article

1. What actually happened
2. The attack chain, at a safe high level
3. Why Claude Opus 5 mattered
4. The quiet-patch problem
5. Identity and developer-tool blast radius
6. Defensive checklist for SaaS and AI teams
7. What this incident does—and does not—show
8. FAQ

What actually happened

The incident began as authorized vulnerability research under OpenAI’s bug-bounty ecosystem. The Hacker News reported on September 19 that Hacktron researchers chained a flaw in the software behind OpenAI’s public help forum with a weakness in OpenAI’s login system, allowing them to take over several employee ChatGPT and Codex accounts and reach an internal code repository.

OpenAI’s own coordinated vulnerability disclosure policy, updated March 25, 2026, explicitly encourages good-faith researchers to report security flaws and recognizes them through its bug-bounty program. That context matters: describing this simply as “Claude hacked OpenAI” erases the researchers’ authorization, disclosure process and stopping conditions.

The important distinction is between the date of the security work and the date of public coverage. The chain reportedly began in late July; the widely circulated news stories appeared in mid-September.

Third-party infrastructure and server risk context. Photo: Taylor Vick / Unsplash (Unsplash License). Illustrative.

The attack chain, at a safe high level

The first part of the chain lived in conventional web infrastructure, not in a frontier AI model. TechCrunch reported that OpenAI’s community forum runs on Discourse and accepted HEIF/HEIC image uploads. Image conversion passed through ImageMagick and then libheif, where the researchers found a memory-safety path that could be used to compromise the server.

This article intentionally omits payload construction, memory-corruption mechanics and reproduction steps. The security lesson does not require operational exploit instructions: a public upload feature delegated decoding to a deep dependency chain, and an old vulnerable build remained reachable from untrusted input.

From that forum foothold, the team reportedly found a separate weakness in the way OpenAI sign-in connected the lower-trust community environment with ChatGPT and Codex accounts. That second issue—not the image decoder alone—allowed the chain to cross an identity boundary.

The researchers then demonstrated the consequence through an OpenAI employee account whose Codex setup was connected to OpenAI’s GitHub organization. According to The Hacker News, they stopped after a harmless pull request and did not read source code, merge changes or touch customer data.

AI-assisted vulnerability-analysis context. Photo: Markus Spiske / Unsplash (Unsplash License). Illustrative.

Why Claude Opus 5 mattered

Anthropic released Claude Opus 5 on July 24, 2026 and described it as a stronger coding and agentic model than Opus 4.8, while noting that it still trailed the company’s Mythos 5 model on cybersecurity tasks. That release date is relevant because Hacktron’s reported comparison happened almost immediately afterward.

According to TechCrunch’s account of Hacktron’s write-up, the researchers had struggled across multiple sessions to produce a working exploit with a special Opus 4.8 configuration. After Opus 5 became available, they presented the same underlying problem and obtained a successful result within hours.

That is evidence of AI-assisted acceleration, not evidence that Claude autonomously chose a target and carried out an end-to-end intrusion. Humans selected the scope, supplied context, evaluated outputs, chained the findings and decided when to stop.

The distinction lines up with Anthropic’s broader September 2026 threat research. Its latest threat-intelligence report says AI is increasingly improving attackers’ speed, scale and depth of knowledge, while humans still retain important decisions such as target selection and review. Digital Pulse Brief previously examined those findings in Anthropic’s September 2026 threat report explained.

Software-dependency review context. Photo: Chris Ried / Unsplash (Unsplash License). Illustrative.

The quiet-patch problem: when the fix exists but scanners do not know

One of the most useful lessons is surprisingly ordinary. TechCrunch reported that the underlying libheif memory bug had already been fixed upstream months earlier, but the fix was not formally flagged as a vulnerability and did not receive a CVE identifier. Hacktron argued that this helped explain why a vulnerable build could remain in the dependency chain.

Digital Pulse Brief could not independently match the incident to a specific published libheif advisory, so this article does not assign a CVE or GHSA to the bug. The libheif security-advisories page contains multiple advisories, but conflating one of them with the Hacktron case would be unsupported.

For defenders, the lesson is that CVE feeds are necessary but incomplete. A mature dependency program also needs a software bill of materials, runtime inventory, upstream release and security-commit monitoring, pinned versions, rebuild discipline and—most importantly—knowledge of whether a vulnerable parser is actually reachable from untrusted input.

Authentication and account-security context. Photo: Dan Nelson / Unsplash (Unsplash License). Illustrative.

Identity and developer-tool blast radius

The highest-impact step was not “a forum was compromised.” It was that access from a lower-trust public service could be turned into access to employee ChatGPT and Codex sessions. When those products are connected to developer tools, the identity boundary becomes more valuable—and more dangerous if it fails.

The Hacker News reported that an affected employee’s Codex was connected to OpenAI’s GitHub organization. That is a practical example of how modern AI workspaces can aggregate permissions: a single session may be able to reach source control, cloud tools, ticketing systems or internal data depending on integrations.

For SaaS and AI teams, the defensive response is not “never use SSO.” It is to segment trust. A public community property should not automatically inherit the same session assurances as internal engineering systems. Sensitive transitions should require fresh or step-up authentication; service tokens should be narrowly scoped and short-lived; OAuth grants should be reviewed; and a compromised low-trust application should not silently carry the user into higher-value developer resources.

This complements the concerns in Digital Pulse Brief’s AI agent data-breach security analysis: when agents and connected tools can act across systems, the quality of permission boundaries matters as much as the intelligence of the model.

Developer-infrastructure and access-segmentation context. Photo: imgix / Unsplash (Unsplash License). Illustrative.

Defensive checklist for SaaS and AI teams

The incident connects old-school application security with new AI-agent risk. The controls below are deliberately technology-agnostic so they remain useful beyond this specific case.

Secure patching and dependency-monitoring context. Photo: Ilya Pavlov / Unsplash (Unsplash License). Illustrative.

What this incident does—and does not—show

What it does show

• AI can reduce exploit-development friction. Hacktron’s reported Opus 4.8/Opus 5 comparison suggests model capability improvements can materially change how quickly a difficult technical task becomes tractable.
• Third-party software remains first-party risk. A vulnerability in a community-platform dependency can matter to the owner of the service when trust boundaries are connected.
• Identity architecture determines blast radius. The forum compromise became more consequential only when it could be chained into higher-value accounts.
• Agent integrations raise the stakes. Connecting Codex or other agents to source control is useful, but every connection is also a permission path that needs least privilege.
• Bug-bounty programs can surface chain risk before criminals do. The researchers reportedly disclosed, stopped and were paid rather than continuing into customer data or source theft.

What it does not show

• It does not establish that Claude independently selected OpenAI as a target or ran the full intrusion autonomously.
• It does not show that ordinary ChatGPT customer accounts were compromised at scale.
• It does not support assigning a specific CVE to the libheif bug from the reporting currently available.
• It does not mean every model or every prompt can reproduce the same result.

OpenAI itself has been publishing more formal safety and misalignment disclosures. For a separate look at agent behavior during training and evaluation, see Digital Pulse Brief’s OpenAI model-misalignment framework explainer. The two stories are related by the growth of agentic capability, but they describe very different types of evidence.

Frequently asked questions

Was OpenAI really hacked with Claude?

Yes, in the limited sense of an authorized security-research exercise that reached OpenAI employee accounts and an internal repository. The researchers were working in a bug-bounty context, responsibly disclosed the findings and stopped after demonstrating access.

Did Claude perform the breach autonomously?

No public evidence reviewed for this article shows an autonomous Claude system independently choosing the target and completing the operation. Claude assisted human researchers with technical work; the team guided the investigation and chained the findings.

Was ChatGPT user data stolen?

The sources reviewed do not report mass theft of ChatGPT customer data. The Hacker News says Hacktron stopped after a harmless internal pull request and did not read source code or touch customer data.

What should security teams change after this?

Prioritize sandboxed media processing, dependency monitoring beyond CVEs, identity segmentation between public and internal services, short-lived scoped credentials, least-privilege developer integrations, and telemetry that can correlate pivots across applications.

Bottom line

The OpenAI/Hacktron research is a useful snapshot of where cybersecurity is heading. AI did not replace the researchers, but a stronger model appears to have accelerated a task that an earlier model struggled to complete. At the same time, the compromise only became serious because familiar security problems—dependency freshness, application isolation, session trust and connected developer permissions—lined up in a chain.

That combination is the practical lesson for defenders: treat frontier models as force multipliers, but do not let the novelty distract from the controls that still decide whether one bug stays local or becomes an organization-wide incident. As AI workspaces connect to more tools, least privilege and identity segmentation become more important, not less.

For more coverage, explore Cybersecurity & Privacy or read how increasingly capable systems are changing agent risk in Digital Pulse Brief’s GPT-6 Astra agent analysis.

Sources and methodology

This is a research-based explainer, not a hands-on penetration test. Digital Pulse Brief cross-checked current first-party material with established security/technology reporting and intentionally omitted exploit payloads and reproduction steps.

• OpenAI — Coordinated vulnerability disclosure policy (updated March 25, 2026)
• Anthropic — Introducing Claude Opus 5 (July 24, 2026)
• Anthropic — Detecting and countering misuse of AI: September 2026 (September 10, 2026)
• TechCrunch — Researchers used Anthropic’s Claude to hack into OpenAI (September 18, 2026)
• The Hacker News — Claude Opus 5 helped researchers take over OpenAI staff accounts (September 19, 2026)
• libheif — official GitHub security advisories (consulted for advisory verification)

You may also like

• Anthropic’s September 2026 Threat Report: How Attackers Are Using Claude
• OpenAI Model Misalignment Framework: 6 Incidents Explained
• AI Agent Data Breach: What Spain’s AEPD Case Means for Cybersecurity