# Hackers used Claude to break into OpenAI

> Three researchers exploited an image processing flaw to access OpenAI's most sensitive code repository in under 72 hours.
- Title: Hackers used Claude to break into OpenAI · The Verge
- Summary: Three researchers exploited an image processing flaw to access OpenAI's most sensitive code repository in under 72 hours. Even AI companies' defenses can be…
- Keywords: openai, anthropic, claude, security breach, hacktron, discourse, heif heist, vulnerability, github monorepo, ai security, image processing exploit, technology
- Source: The Verge — https://theverge.com/ai-artificial-intelligence/997444/openai-hack-claude-heif-heist
- Author: Stevie Bonifield
- Published: 2026-09-18T15:30:16+00:00
- Read time: 1 min
- Topics: openai, anthropic, claude, security breach, hacktron, discourse, heif heist, vulnerability, github monorepo, ai security, image processing exploit, technology
## Three hackers breached OpenAI
A team from Hacktron used Anthropic's Claude to break into OpenAI employee accounts in less than 72 hours, gaining access to the company's GitHub repository containing algorithmic secrets.
## They exploited a forum image flaw
The team broke in through Discourse, OpenAI's community forum software, by exploiting how it processes HEIF image files. Claude Opus 5 launched July 24th, and by 10 AM the next day they had remote code execution.
## They proved access without stealing code
Rather than download OpenAI's internal code, the researchers sent a pull request from a stolen employee account to prove they had gained access to the Monorepo repository.
## The hack worked on eight companies
Hacktron adapted their HEIF Heist project to target Slack, Meta, GitHub Enterprise, Rails, Next.js, ImageMagick, and others in just one or two days, spending less than $3,000 in Claude tokens.
## Only Shopify detected the attack
Of all the targets, only Shopify detected the HEIF Heist project. OpenAI paid Hacktron $6,500 for reporting the bug, which has since been fixed.

> I don't think we are as strong as Chinese threat actors… We're just three guys with Claude and Codex subscriptions.
## Claude itself enabled the hack
The researchers used Claude Opus versions 4.8 and 5 to help identify and exploit the image processing vulnerability, turning Anthropic's AI against OpenAI's security.
## Key takeaway

Even AI companies' defenses can be breached through third-party services, and the tools meant to secure systems can be turned against them.