The intrusion began with a flaw in a place no one was watching. On July 25, a team from the security firm Hacktron chained two vulnerabilities together, using Anthropic’s Claude model as their assistant, and walked from a public forum into OpenAI’s internal code repositories in under seventy-two hours. The company disclosed the test on September 17, and OpenAI has paid a $6,500 bounty for the finding.
The chain had two links. The first was a heap buffer overflow in libheif, a library that handles image files, sitting in the community forum’s image upload process. The second was a logic flaw in OpenAI’s single sign-on. Used together, they let the team obtain an employee account, and from there they reached ChatGPT and Codex, the company’s coding tool, and finally the internal code repositories.
The proof that the access was real was also the proof that the researchers had been careful. Rather than read sensitive information, they used an employee’s Codex to open a pull request inside the internal repository. The pull request was the evidence: it could not have existed without genuine access, and it did not require them to take anything they should not have.
The role of Claude is the detail that has drawn the most attention. The researchers used the model as a tool through the process, helping to identify and chain the vulnerabilities. A security researcher working with an AI assistant is now a standard arrangement, but the fact that one AI company’s model helped breach another AI company’s systems gives the story a symmetry that no press release would have chosen.
The timeline is the second striking detail. From discovery of the first vulnerability to access to the code repository, the whole sequence took less than seventy-two hours. That speed is a function of both the flaws and the tools: the forum bug gave a foothold, the single sign-on flaw widened it, and the AI assistant compressed the time it took to move between the two.
OpenAI’s response has been measured. The company paid the bounty, which under its program’s terms is an acknowledgment that the finding is real and valuable, and the amount, $6,500, reflects the program’s assessment of the severity rather than any drama. The company has not said publicly how it fixed the flaws, only that it has.
The episode shows how much surface a large AI company exposes. The front door, the model itself, may be well defended, but the back doors, the forums, the login flows, the image libraries, are the same ordinary software that every company runs, and they fail in the same ordinary ways. A company that is hardening its models against attack is also a company with a web forum and a single sign-on page.
The single sign-on flaw is the more important of the two, because it converted a foothold into credentials. A forum bug gets you into the forum; a login flaw gets you into the accounts of the people who work there. The combination is what made the jump from the public surface to the internal network possible, and it is the kind of flaw that security teams worry about most, because it does not require a sophisticated attacker to exploit.
For the industry, the lesson is not that AI is a threat or a savior. It is that the tools work both ways. The same models that help defenders find flaws faster also help attackers chain them faster, and the race between the two is being run with the same equipment. The seventy-two-hour timeline is the measure of how fast that race has become.
The disclosure is part of a larger pattern. Security firms have begun using AI models as standard equipment in their testing, and the results are arriving as a stream of findings that would have taken longer to surface without the tools. Hacktron’s test is one data point in that stream, notable for the target and the speed, but part of a trend that is changing how both attackers and defenders work.
The bounty amount has drawn some comment, and it points to a mismatch the industry has not fully resolved. A breach of an internal code repository is the kind of finding that, in a different context, would command a far larger payout, because the repository is where the company’s most valuable work lives. The $6,500 figure reflects the rules of a bug bounty program, which prices findings by severity and scope rather than by the drama of the target. The gap between what the finding was worth and what it paid is part of why some researchers now push companies to price security by its real value.
The two flaws themselves are the ordinary kind that security teams fix and forget. A heap buffer overflow in an image library is a textbook memory-safety bug, the sort that has plagued C and C++ code for decades, and a single sign-on logic flaw is the sort of mistake that creeps in when login flows grow complex. Neither required a nation-state to find; together, in the hands of a skilled team with a fast assistant, they were enough to cross the line from public to internal.
For Anthropic, the episode is awkward only in the retelling. Claude is a general tool, and the researchers used it the way any analyst would use any capable model, to reason about code and to connect the dots faster. Nothing in the disclosure suggests the model did anything it was not supposed to do, and nothing suggests Anthropic had any role beyond making the tool. But the optics, one company’s model helping to breach a rival’s systems, are the kind that the industry would rather not produce.
