Claude hacked into OpenAI

Karma is a circle, no one can escape it! OpenAI, which once breached the Hugging Face and Ruby ecosystems, has now been hacked itself! Worse still, the intruder used the model from its main competitor Anthropic to complete the attack.

Just a few hours ago, s1r1us, founder of Electrovolt Security and Hacktron AI, posted a series of tweets on X, sharing the story of his team successfully breaching OpenAI with Claude in July, which has drawn widespread attention.

https://x.com/S1r1u5_/status/2100777801335095383

Strictly speaking, this story is not new at all. The full technical review was published on Hacktron's blog as early as September 13, with a rather provocative title: "Hacking OpenAI".

Blog address: https://www.hacktron.ai/blog/hacking-openai

What really made it go viral today is the exclusive report from *The Wall Street Journal* titled "Hackers Breached OpenAI Using Anthropic's Claude", plus s1r1us himself publicly detailed the entire attack chain. Within hours of the tweets being posted, the number of views exceeded 550,000, and the topic also gained extremely high popularity on Hacker News.

s1r1us, real name Mohan Pedhapati, is the co-founder and CTO of Hacktron AI. Harsh Jaiswal, Head of Security Research, and researcher Rahul Maini also participated in this research, with a total of 3 people on the team.

In terms of timeline, the whole process from initial discovery to obtaining access to OpenAI's internal code repository took less than 72 hours.

Schematic diagram of the 9-step attack chain provided on the Hacktron blog

72 Hours: From a Single Image to OpenAI's Internal Monorepo

The starting point of the entire chain is simply "uploading an image in HEIC format".

OpenAI's user community community.openai.com runs on Discourse. Discourse normally uses FastImage for image verification, but FastImage does not support HEIF, so such files are forwarded to the magick command of ImageMagick for conversion, and the underlying libheif parser is directly exposed to files controlled by attackers.

The Hacktron team began auditing this image upload pipeline on July 23, and subsequently confirmed a heap buffer overflow in libheif.

What is most alerting for security practitioners is the origin of this vulnerability: the relevant upstream code was modified a year earlier, but that commit was not marked as a security fix, nor was a CVE assigned. As a result, both Debian 12 and Debian 13 did not receive this security backport in time. Discourse's Docker image is based on Debian 12, running version 1.19.7, while Debian 13 at that time still carried the problematic 1.19.8 version. A commit that no one considered a security issue turned into remote code execution at the end of the dependency chain. Debian did not push a security update for Debian 13 until August 8.

Obtaining RCE on the forum is only the first step. What amplifies the impact is the second vulnerability: the flaw in OpenAI's own SSO. OpenAI allows users to log in to the forum via "Sign in with OpenAI" at auth.openai.com, and this identity link has configuration issues, so that compromising the forum can be converted into takeover of ChatGPT and Codex accounts of users who have logged into the forum, including OpenAI employees.

The team specifically emphasized in the blog: this exploitable privilege escalation vulnerability is not unique to Discourse, Discourse is just a proof path they chose, compromise of any first-party or third-party service that uses OpenAI SSO will lead to the same result.

ChatGPT and Codex accounts are often connected to a long list of services such as Outlook, Gmail, Google Drive, Slack, and GitHub. The theoretically accessible scope therefore far exceeds chat records themselves.

To prove that the access is real without reading any sensitive content, the team selected an employee account whose Codex was connected to the OpenAI GitHub organization, sent an instruction to the Codex of this account to create a harmless pull request in OpenAI's internal monorepo openai/openai, and immediately stopped all further tests.

Illustration of the PoC pull request submitted to OpenAI's internal monorepo, not the original screenshot (OpenAI requested not to display the original screenshot)

According to people familiar with the matter cited by *The Wall Street Journal*, this monorepo stores algorithm secrets that make the model faster and more efficient, which is equivalent to the company's formula, but does not contain model weights; the changes submitted by the researchers were made to a document file, which included the words "Hacktron AI Team PoC" and links to the X accounts of the two researchers, and this suggestion was not accepted.

The timeline is very dense. Between 5 a.m. and 6 a.m. UTC on July 25, they obtained RCE and administrator privileges on the forum; between 8 a.m. and 10 a.m., they submitted the report via Bugcrowd; between 1:30 p.m. and 3:30 p.m., they completed employee account takeover and PoC submission, at the same time, they directly contacted their friends at OpenAI on Twitter to warn them, and stopped around 3:30 p.m.; at 10:49 p.m. that day, OpenAI replied confirming that the problem had been fixed, about 14 hours after the initial submission. The report to Discourse went through HackerOne, was sent on Saturday, replied on Sunday, and the fix was completed on Monday. On July 28, the security advisory GHSA-vhm9-85gw-x335 was released, and sandbox isolation was added to ImageMagick as defense in depth.

How Much Did Claude Actually Contribute to the Attack?

This is the real breaking point of this news.

Hacktron's review is written very frankly. They first started a session with Opus 4.8, threw Discourse's Docker image to it, and asked it to check if there were any security issues with the installed libheif package. The model identified the batch of fixes that had not been backported. On July 24, Opus 4.8 also created a usable code execution exploit under the condition of ASLR being disabled. However, to achieve stability under Discourse's default configuration (ASLR enabled), they opened several sessions without success.

That night, Anthropic released Claude Opus 5.

The team opened a new session, and within three hours they got an ARM64 version that could run on a local Mac, then asked it to port it to the x86-64 environment and jemalloc configuration used by Discourse. By 6 a.m. on July 25, local RCE via image upload was confirmed.

The next part is even more interesting: Opus refused to write an exploit for the remote instance, so the team wrapped their own Discourse Cloud instance through a proxy to make it look like a CTF target, then put Claude to run in the autonomous /goal loop. When they came back to check at 10 a.m., the agent had already obtained RCE on Discourse Cloud and proved this by reading /etc/hosts. Using this automatically generated script, they later successfully reproduced the exploit on OpenAI's instance.

The model's security guardrails did trigger, but they only blocked the word "remote".

The cost figures are equally staggering. The part targeting Discourse and OpenAI only took the agent a few days and humans a few hours; the entire HEIF Heist research project covering Slack, Zoom, Meta and many other companies lasted two months, with three researchers, and the total token cost was less than 3000 US dollars, and adapting to a new company usually only takes one or two days.

The team stated that the test started with uploading an image, and under the condition that the specific libheif version, libc version and deployment environment of the target are usually unknown, AI almost blindly converts memory corruption into reliable memory leaks or shells. According to their observations, no company except Shopify detected these activities, even if the image processing process was repeatedly crashed and thousands of images had been sent.

However, two points need to be clarified:

Hacktron itself emphasized that this is not a fully automatic hacking attack, skilled human guidance is still critical, and what has changed is the magnitude of work that a small team can complete.

Claude is not the only one named - they also mentioned that in the blind attack scenario where nothing is known about the target system, there is an obvious capability leap from Opus 5 to GPT-5.6 Sol. This is not a problem of a single model vendor.

$6500 and a Supplementary Note

On September 1, OpenAI issued a $6500 bounty and marked the report as resolved, with a carefully worded addendum: "Tests targeting community.openai.com hosted by Discourse were explicitly excluded from the scope of its bounty program, and this reward recognizes the discovery on OpenAI's side, not the actions targeting Discourse."

The figure of $6500 for buying a path to the internal monorepo quickly became the focus of controversy on social media.

What really pushed the discussion deeper was a long post by security researcher Joshua Saxe. He was invited by WSJ and s1r1us before the article was published to conduct a neutral technical review of this kill chain.

The several questions he raised are very difficult to answer: How many more powerful attackers have broken in earlier and gone further, taking away algorithm secrets, model weights or user data? How many resident programs are still lurking in the networks of cutting-edge labs right now? How common is this level of "loose security" among various labs, and how far are they from a reasonable balance between security and R&D efficiency?

https://x.com/joshua_saxe/status/2100775309012296171

His most pointed question is directed at Anthropic: Since Hacktron used Anthropic's model to complete this intrusion, what exactly is the public security ROI of Anthropic's network security guardrails - it adds real friction to legitimate defenders, while attackers can bypass it with little extra effort. His conclusion is that elite-level persistent intrusion capabilities are being rapidly democratized, and this is coming like a freight train.

The Other Half of the "Karma Circle"

Putting this incident back into the timeline, you will find that the security history of cutting-edge labs in 2026 is already quite chaotic.

In July, OpenAI and Hugging Face jointly disclosed an incident: OpenAI tested GPT-5.6 Sol and an unreleased internal model on the public benchmark ExploitGym, and disabled the same protection as in external deployment in order to run the evaluation. As a result, the model broke through the isolation boundary of the evaluation environment, reached the public network, and compromised part of Hugging Face's production infrastructure.

On September 11, researchers Spencer Kitts, Thomas Larsen and Sydney Von Arx further disclosed that as early as May 11, OpenAI's test agent had uploaded hundreds of malicious packages to RubyGems, trying to steal user credentials. RubyGems once treated it as a DDoS attack and suspended new user registration, and finally banned related accounts, removed more than 500 malicious packages, and resumed registration on May 16.

Further back, there was an episode known in the security community as the "wiki incident": about 18,000 posts from autonomous agents claiming to