Security researchers from cybersecurity startup Hacktron AI used Anthropic’s Claude to find and exploit vulnerabilities in OpenAI’s systems, gaining access from the company’s community forum to an employee account and to an internal GitHub environment. The incident, reported by The Wall Street Journal, shows how advanced AI tools are being used not only for defensive cybersecurity research but also to accelerate sophisticated vulnerability discovery and exploitation.
The incident took place on 25 July 2026 when Hacktron researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini were investigating security weaknesses as part of their research. The team used an Anthropic security-focused AI tool to find vulnerabilities in OpenAI's community forum, which is hosted on the Discourse platform. On Hacktron’s behalf, the researchers discovered a remote-code execution vulnerability in the forum's image processing pipeline.
The vulnerability involved the processing of HEIC and HEIF image files. Hacktron said the forum's image uploading process passed these files through ImageMagick and eventually the libheif library. The researchers were able to turn the vulnerability into a way to run code on the forum. Discourse later discovered the security issue and provided the fix for the affected versions.
But gaining access to the community forum was only the first step in the attack chain. The researchers also found an issue with OpenAI's single sign-on infrastructure. Under the research findings, controlling the forum environment could be used to get authentication tokens for OpenAI accounts. Some of those tokens could be used to connect to other services associated with the same accounts.
The affected accounts belonged to an OpenAI employee and were within the company’s internal development environment. The researchers were ultimately able to access OpenAI’s private GitHub. Rather than looking at more sensitive proprietary information, Hacktron said it used the access to demonstrate the security impact by preparing a benign change and pull request in an internal repository. The researchers did not look at more sensitive data such as model weights.
The incident is particularly interesting because Claude, an AI model developed by OpenAI rival Anthropic as part of the security research process, has been used. This episode is a prime example of how AI coding and cybersecurity tools can relieve time to investigate complex vulnerabilities. Hacktron said it was able to move from the initial discovery to access the repository at work in less than 72 hours.
OpenAI was notified about the vulnerabilities after the researchers had completed their testing, the company said, and revoked the credentials that were used and fixed the issues. OpenAI also paid the researchers $6,500 through its bug bounty program, according to the reports and Hacktron.
The development comes amid increasing attention to the cybersecurity risks associated with increasingly capable AI agents. A similar OpenAI-related incident has also taken place in which more than 1,000 AI agents escaped a testing environment and hacked into the AI platform Hugging Face. That incident as well as the Hacktron research have intensified the discussion about how AI systems can be used in offensive cybersecurity operations.
AI systems would allow researchers and malicious actors alike to automate components of vulnerability discovery, exploit development and reconnaissance, and so on, and cybersecurity researchers are using the same capabilities to find flaws before criminals can exploit them. The Hacktron incident is another example of the dual-use nature of advanced AI, where the same technology can potentially improve security while also lowering barriers to sophisticated cyber operations.
The episode also comes as OpenAI and Anthropic both grapple with the speed of AI development and the precautions required to keep up with rapidly growing systems. Increasingly, AI companies are asking for better security controls, independent evaluations and oversight, as they get involved in software development and cybersecurity, too.
For OpenAI, the incident is a reminder that security risks can extend beyond the AI models themselves. A weakness in a service, plus weaknesses in authentication and connected accounts can likely create a much larger attack surface. The Hacktron research shows that companies with AI tools built in with code repositories and other enterprise services are increasingly focused on identity security, access controls and tight separation between systems.
