It started as a bug bounty hunt. Three researchers at a small cybersecurity startup called Hacktron AI spent a few days chaining together two software vulnerabilities, and before long they were staring at OpenAI’s internal GitHub repository — the one insiders call “Monorepo,” the secret sauce that makes the company’s AI models run faster. The key that unlocked the door? A rival AI: Anthropic’s Claude.
The story, first reported by the Wall Street Journal and confirmed Thursday by multiple outlets, is the latest evidence that the most capable AI models have crossed a threshold. They’re not just tools for writing code or summarizing documents anymore. In the right hands — or the wrong ones — they’re full-fledged security researchers in their own right, capable of finding and exploiting vulnerabilities that would have required a seasoned expert team and months of work just a few years ago.
The Breach: A 72-Hour Sprint
Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini of Hacktron AI were participating in OpenAI’s official bug bounty program when they identified a vulnerability in how OpenAI’s image processing pipeline handled HEIF (High Efficiency Image Format) files. This attack vector — which they dubbed “HEIF Heist” — is part of a broader research project they’ve been running for two months, uncovering image-decoding bugs in systems from Slack and Zoom to Meta.
The exploit worked by chaining two distinct flaws: a heap overflow bug in OpenAI’s image decoder, and a single sign-on (SSO) vulnerability. Together, the two holes gave the team access to an OpenAI employee’s ChatGPT account — and through that account, to the company’s internal coding environment, including access to its private GitHub repository.
The entire operation, from identifying the vulnerability to landing inside OpenAI’s infrastructure, took fewer than 72 hours. The researchers spent less than $3,000 in AI token costs across the whole project. The human hours required? Just a few.
“We’re just three guys with Claude and Codex subscriptions,” Mohan Pedhapati told the Journal.
Claude Was the Key — But Not the First Try
The researchers didn’t succeed on the first attempt. They initially turned to Anthropic’s Claude Opus 4.8, but the model “struggled across several sessions to produce a working exploit,” according to Hacktron’s own published report on the incident. The team shelved the approach — until Anthropic released Claude Opus 5.
With the newer, more powerful model, they succeeded. In their writeup, the researchers noted that “every new model is getting increasingly capable,” a line that landed with extra weight given the context. Anthropic has made a special version of its models available to “qualified cybersecurity practitioners,” which the team had access to for this research.
OpenAI, for its part, was notified through responsible disclosure. The company patched the SSO vulnerability roughly 14 hours after the initial submission and paid the team a $6,500 bug bounty — a number that, given the access obtained, seems modest by most security industry standards.
Rather than exploring OpenAI’s internal systems, the researchers demonstrated the access responsibly: they used the compromised employee’s Codex coding assistant to open a pull request in OpenAI’s internal repository purely to prove the access was real, then stopped. “We’re not here to steal,” Pedhapati said.
What Was Inside
The repository the researchers accessed — Monorepo — is, according to sources familiar with OpenAI’s infrastructure, the central code repository underlying the company’s AI model infrastructure. It reportedly contains the optimizations and systems that make OpenAI’s models operate efficiently at scale. The researchers say they didn’t read or exfiltrate its contents, but the fact that they could have is the point.
“Software has long benefited from a kind of security through complexity,” the Hacktron team wrote in their concluding remarks. “AI is removing that protection by turning more of this scarce expertise into compute. Work that once required a well-resourced team and months of effort can now be compressed into days.”
A Pattern, Not an Anomaly
This incident doesn’t exist in isolation. It’s the latest in a string of security disclosures targeting AI companies, and it arrives at a particularly tense moment in the industry. Anthropic CEO Dario Amodei published an essay just last week calling for AI companies to voluntarily slow the pace of frontier AI development, citing the risk that security and safety capabilities can’t keep up with raw model capability.
The irony is not subtle: the very capabilities Amodei warned about were used within days of that essay to breach the systems of OpenAI — the company whose rapid pace of development Amodei was most directly referencing.
OpenAI itself has also been pushing cybersecurity as a feature rather than just a challenge. The company recently disclosed that its forthcoming Astra model meets the “Critical” cybersecurity capability threshold under its Preparedness Framework, and has been offering advanced cybersecurity features to a selected group of testers through its Daybreak Blue program.
The Dual-Use Problem Crystallized
The Hacktron hack crystallizes a dilemma the security industry has been wrestling with since powerful AI models became widely available. These systems are extraordinary at the kind of systematic, creative problem-solving that vulnerability research requires: analyzing code, generating novel exploit chains, adapting approaches when one path fails. The same traits that make Claude useful for a security researcher doing legitimate defensive work also make it useful for building attacks.
In this case, the researchers were playing by the rules — operating inside a bug bounty program, disclosing responsibly, not exfiltrating data. But the barrier to doing the same thing without those guardrails is dropping with every new model release.
AI-powered bug bounty work has been accelerating across the industry. Multiple top-ranked security researchers have reported that AI assistance has compressed their discovery timelines by 60 to 80 percent. Startups like Hacktron are increasingly building their entire research pipeline around AI-assisted vulnerability discovery.
For defenders, the math is getting harder. Security teams are facing adversaries — even well-intentioned ones — with AI tools that dramatically amplify their capability. Patching a complex SSO vulnerability in 14 hours, as OpenAI did, is genuinely fast work. But the Hacktron team needed only 72 hours to find and exploit it. That gap needs to close considerably for the current approach to keep pace.
What Comes Next
OpenAI confirmed to multiple outlets that it has fixed the vulnerabilities and thanked the researchers. There’s no indication of malicious use or data exfiltration. But the company’s internal repository was, however briefly, within reach of outsiders — and the tool that got them there is available to any subscriber who qualifies for Anthropic’s cybersecurity practitioner access.
The researchers have published their full methodology at Hacktron’s website, including the Claude session logs and the specific image-file attack chain they developed. They say they hope it accelerates defensive research as much as offensive capability.
“Security assumptions must catch up with attacker capabilities,” they wrote. “That gap is now widening faster than ever before.”
In the meantime, the AI arms race has found yet another front — and the bounty for finding the next gap is still just $6,500.
