A three-person team at security startup Hacktron AI claims it accessed OpenAI employee accounts and a private code repository on July 25, demonstrated the breach with a harmless pull request, and walked away with a reported $6,500 bug bounty. According to multiple outlets including TechCrunch and Business Insider, the team used Anthropic’s Claude to help develop the exploit.
This incident shows that AI-assisted exploit development can accelerate a real attack chain against a real target with real internal systems at stake.
How the Breach Worked
A forum image-processing bug and a misconfigured SSO combined to produce access far beyond the original attack surface.
According to Hacktron’s self-reported write-up, the attack chained two distinct weaknesses. The first was a libheif heap overflow affecting image processing in OpenAI’s Discourse-based forum; the second was an SSO misconfiguration that let the team pivot from the forum environment into employee-linked ChatGPT and Codex accounts.
That pivot is the critical detail. A bug in forum software rarely signals a path to internal developer tooling, yet the identity-system weakness made exactly that possible.
Hacktron says researchers first attempted exploit development with Claude Opus 4.8 and could not produce a reliable result. Claude Opus 5 succeeded. Multiple reports note the team was using an authorized, cybersecurity-oriented version of Claude, not a standard consumer chat session.
Proof of access came in the form of a harmless pull request submitted to OpenAI’s private repository. According to multiple outlets, the team did not download or examine sensitive source code; OpenAI’s own review reportedly found only limited reads of private repository metadata and code.
The strongest specifics come from Hacktron’s own account, so the full scope of repository access remains self-reported.
OpenAI’s Response and What It Signals
A rapid patch and a bounty payment close the immediate loop, but the broader lesson concerns how ordinary vulnerabilities combine into serious ones.
OpenAI reportedly patched both vulnerabilities within approximately 14 hours of notification and paid the $6,500 bounty, according to Business Insider and other outlets. Neither the patch timeline nor the bounty amount has been publicly confirmed by OpenAI directly.
Two ordinary vulnerability classes, one in image-processing code and one in identity configuration, combined to produce access far beyond either weakness’s individual reach. Security researchers describe this pattern as composability: separate, low-severity flaws that chain into something with genuinely serious reach.
Claude’s role is real but carefully bounded. Human researchers still identified the vulnerability chain, validated the SSO pivot, and made the call on responsible disclosure.
The model compressed the exploit development timeline. It did not replace the judgment or ethics that responsible security research requires.
This incident is a practical signal for security teams: peripheral software such as forum platforms, SSO configurations, and image-processing libraries deserve scrutiny alongside higher-profile assets, particularly as AI tools make it faster to turn a low-severity finding into one that reaches internal repositories.
