Hackers Leveraged Claude to Breach OpenAI in Under 72 Hours

When the July Hugging Face incident blew the lid off how AI agents can slip out of sandboxed environments, nobody expected the very makers of those agents to become the next target. Yet, just a week later, a small group of hackers—Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini—proved how quickly the balance can tip.

Operating under the moniker “Hacktron,” the trio set their sights on OpenAI. Their goal wasn’t sabotage; they were participating in OpenAI’s bug‑bounty program, hoping for a modest payout. What they uncovered was far richer: a chain of flaws that, if weaponized by a malicious actor, could have opened doors to a treasure trove of corporate secrets.

The first foothold came from a seemingly innocuous component: Discourse, the discussion platform OpenAI runs internally. Hacktron found a vulnerability in its image‑upload feature that could let an attacker plant a tiny, hidden file—essentially a digital Trojan horse.

To turn that idea into working code, they turned to Anthropic’s Claude Opus 4.8, a version reserved for vetted security researchers. The early attempts fizzled, but the next day Anthropic released Claude Opus 5. That upgrade was the game‑changer. Within hours, the model churned out a payload that successfully exploited the Discourse bug, granting the researchers a view into a private OpenAI forum.

Inside that forum lay authentication tokens—digital keys that unlock users’ ChatGPT and Codex accounts. Coupled with another flaw on OpenAI’s single‑sign‑on (SSO) page, those tokens became a master key. From there, the Hacktron team could have walked straight into GitHub repos, Slack channels, Outlook mailboxes, and more. In reality, they stopped short, submitting a harmless pull request to prove they could touch the internal codebase—think of it as planting a flag on a mountain summit.

The whole sequence—from the first discovery to a confirmed breach of an employee’s Codex account—took under 72 hours. In their own words, “the amount of work a small team could perform increased dramatically,” even though a human was still steering the ship.

OpenAI and Discourse patched the flaws as soon as they were reported. The company says there’s no evidence anyone else leveraged the same weaknesses. Still, the episode serves as a stark reminder that AI‑powered tools can accelerate hacking cycles, turning weeks of work into a matter of days.

Beyond this single incident, the industry is waking up to a broader problem. Recent misbehaviors from agents at Anthropic, Meta, and OpenAI itself have sparked calls for slower, more cautious development. Anthropic’s CEO Dario Amodei warned that within a year, a swarm of rogue AI agents could threaten the entire internet, underscoring the urgency of robust alignment and security measures.