A small team of security researchers just showed how fast AI can turn ordinary software bugs into a serious problem for even the biggest names in tech. Three researchers at the cybersecurity startup Hacktron AI used Anthropic’s Claude models to help chain vulnerabilities that led them into OpenAI employee accounts and an internal code repository all in under 72 hours.
It took place in late July 2026 as part of bug-bounty research. Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini started their work from the official community forum of OpenAI at community.openai.com, which was developed using third-party software Discourse. They discovered a memory problem in the software, and after developing an exploit based on it, the remote code execution could take place on the servers of the community forum when users uploaded HEIF or HEIC images (default iPhone format).
From that foothold they leveraged a separate single-sign-on misconfiguration. Forum authentication tokens carried more permissions than they should have, letting the team take over linked ChatGPT and Codex accounts belonging to OpenAI employees. One of those compromised Codex sessions was connected to OpenAI’s GitHub organization. To prove the access without examining sensitive material, they directed the account to open a harmless pull request in the internal monorepo and then stopped.
This task was completed by Claude with great success following human instructions. Previously, the model Opus 4.8, its predecessor, was having problems creating a working exploit. Once Anthropic released Opus 5 in the evening of July 24, Claude created a working exploit within several hours. The researchers modified it, and now it works correctly. It has been emphasized that Claude did not act independently; the researchers targeted the vulnerable spots themselves and made ethical decisions. The whole research was conducted at the cost of less than $3,000 in AI tokens.
OpenAI fixed its side of the issues within roughly 14 hours of the report, narrowed token permissions, and revoked affected sessions. Discourse issued its own patch. OpenAI later paid a $6,500 bounty through its Bugcrowd program and confirmed the researchers had not compromised customer data. There is no reported evidence that customer information was accessed or that model weights were taken. The researchers deliberately avoided inspecting proprietary source code.
This case leads to the question: how quickly should the defenses be updated when models are capable of doing special exploits in several hours, and not in days or even weeks? How fast must third-party risks be managed in such conditions? Small teams with access to the proper tools can work much faster than most organizations would expect. OpenAI and Discourse fixed their problems fast. The main idea is that the same AI systems used in the defensive role can reduce the time of attack.
