Hacktron used Claude to breach OpenAI in under 72 hours

The report, published in September 2026 by three researchers at security firm Hacktron, was drawn from work done inside OpenAI's bug bounty program. It describes a path that started with an image upload on OpenAI's help forum and ended with access to employee ChatGPT and Codex accounts, plus one harmless pull request against an internal repository.

The two root causes are mundane. An image-processing library called libheif had a security fix that carried no CVE and was never pulled into Debian's packages, and OpenAI's SSO was misconfigured. Neither problem came from AI. What the researchers passed to AI was the exploit work itself: starting without exact knowledge of the target library version, libc version, or deployment environment, they adapted an ARM64 exploit that ran in about three hours with Opus 5, after repeated stumbles on hardened environments with Opus 4.8.

The authors frame this as AI converting scarce expertise into compute — pay, and you can get something like a specialist. The practical reading is that defenses built on attackers' effort rather than on design are weakening, and the outcome for any given organization likely hinges on whether it has quietly exposed features it does not use and blurry trust boundaries between its core service and peripheral tools.