Researchers used Claude to reach an OpenAI code repository through chained flaws

Researchers at cybersecurity company Hacktron used Anthropic’s Claude to help exploit vulnerabilities affecting OpenAI’s community forum and an OpenAI single sign-on system, eventually reaching an internal software repository. The incident matters because AI did not replace the security researchers, but it appears to have made a difficult exploit cheaper and faster to develop.

OpenAI Watch analysis

What happened

According to Malwarebytes, Hacktron researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini chained two vulnerabilities. The first involved a flaw in the libheif image-processing library used by Discourse, the software running OpenAI’s community forum. A specially crafted image could give an attacker control of the forum server.

The researchers then used a flaw in OpenAI’s single sign-on system to reach ChatGPT and Codex accounts belonging to people who had logged into the forum. One employee’s Codex account was connected to OpenAI’s GitHub organisation, allowing the team to access an internal software repository. Malwarebytes says the researchers did not view sensitive information or make damaging changes. Instead, they created a harmless pull request to demonstrate access.

OpenAI fixed its part of the problem about 14 hours after Hacktron submitted its report, and later paid a $6,500 bug bounty. The researchers also found related image-processing weaknesses affecting other services, including Slack, Meta and GitHub, according to Malwarebytes.

The AI angle is unusually concrete. Hacktron first used Claude Opus 4.8 while investigating the libheif issue, but says the model could not produce a reliable exploit. After Claude Opus 5 was released, the researchers say they built a working exploit overnight. Malwarebytes reports that the model initially refused to help with a remote exploit, so the researchers framed the task as a capture-the-flag exercise.

Why it matters

This was not autonomous hacking. Hacktron says skilled human guidance remained essential, and the research took two months and involved three people. But Malwarebytes reports that the project cost less than $3,000 in AI-token spending, while adapting the exploit to a new target took roughly a day or two on average.

That combination is the uncomfortable bit. Security expertise remains necessary, but AI may reduce the time and money required to apply it across many targets. A defensive model refusing one request is not the same as a robust security boundary, particularly when a determined operator can reframe the task.

The immediate practical lesson is less glamorous than the headline: forum software, image decoders and single sign-on systems can become one attack path when they are connected to developer accounts and internal repositories. Organisations should treat those links as a single security surface, not a collection of unrelated services.

Our read

Hacktron’s account is a useful warning, not proof that AI has started conducting independent cyber campaigns. The people found the flaws, chained the systems and chose the targets. Claude appears to have accelerated parts of the work, which is already consequential enough without giving the chatbot a tiny hacker hoodie.

The most important question is whether bug-bounty programmes and AI safety filters can keep pace with exploit development. OpenAI’s rapid fix and bounty are encouraging. The wider lesson is that an account used for community support should not become an unexpected key to a company’s codebase.

What to watch

• Vendor fixes:
  whether Discourse, OpenAI and affected library maintainers publish fuller technical details and patch coverage.
• Account boundaries:
  whether companies tighten links between forums, single sign-on, coding tools and internal repositories.
• Model safeguards:
  whether future Claude releases make this class of assistance harder to obtain without blocking legitimate security research.
• Independent confirmation:
  whether OpenAI or Discourse publicly confirms the full attack chain and scope described by Hacktron. Sources and evidence Malwarebytes, published 22 September 2026, is the basis for the reported attack chain, researchers’ names, use of Claude, OpenAI’s response, the bug bounty and the wider HEIF Heist findings. The evidence supports an attributed account of security research and claimed remediation. It does not establish that the researchers conducted damaging activity, that the operation was fully autonomous, or that every affected service remains vulnerable.

Discussion spark: Should AI companies prioritise stricter safeguards against exploit assistance, even if researchers can bypass them with simple reframing, or is better isolation between accounts and internal systems the more important fix?

OpenAI Watch is independently operated by WittyWires. It is not affiliated with, endorsed by, or operated by OpenAI.