Security researchers used Anthropic’s Claude to demonstrate a supply-chain attack on OpenAI’s internal systems

A three-person team at Hacktron, an independent security research group, reported that they used Anthropic’s Claude Opus 4.8 and 5 to assist in compromising OpenAI employee accounts within 72 hours. The researchers exploited a vulnerability in Discourse, the third-party platform hosting OpenAI’s community forums, by leveraging a flaw in how the system processed HEIF image files. According to the team, they achieved remote code execution on Discourse Cloud and gained access to OpenAI’s GitHub repository, referred to as “Monorepo,” which is described by sources as containing “OpenAI’s algorithmic secrets.”

The researchers did not access internal code within Monorepo themselves, but demonstrated their access by sending a pull request from an employee’s Codex account. They adapted their exploit to target multiple organizations, including Slack, Meta, GitHub Enterprise, Rails, Next.js, ImageMagick, and others, using less than $3,000 in API tokens. The team stated that only one target, Shopify, reportedly detected their activity during the campaign.

Hacktron reported the vulnerabilities to Discourse and OpenAI, both of which have since been patched. OpenAI paid the research team a $6,500 bug bounty for the disclosure. The researchers emphasized the relative ease of the operation, with Hacktron CTO Mohan Pedhapati noting, “I don’t think we are as strong as Chinese threat actors… We’re just three guys with Claude and Codex subscriptions.”

The timeline provided by the researchers indicates that Claude Opus 5 launched on the evening of July 24, and by 10 AM the following day, they had achieved remote code execution on Discourse Cloud and accessed OpenAI’s instance.