Security researchers use Claude to breach OpenAI accounts in 72 hours

A trio of independent security researchers operating under the name Hacktron reported that they were able to compromise OpenAI employee accounts in under 72 hours by leveraging Anthropic’s Claude Opus 4.8 and 5 language models, according to a Wall Street Journal article. The researchers accessed OpenAI’s GitHub “Monorepo,” a repository described by sources as containing the company’s core algorithmic assets, and demonstrated their foothold by submitting a pull request from an employee’s Codex account. Their intrusion also extended to OpenAI’s community platform hosted on Discourse, a third‑party service used for internal discussions.

OpenAI has not publicly commented on the breach, and no evidence suggests that the attackers extracted or altered the internal code within the Monorepo beyond the proof‑of‑concept pull request. The incident highlights the potential risks associated with using advanced language models for authentication or credential handling and underscores the need for heightened security measures around third‑party services. Further details are pending as the investigation continues.