Artificial intelligence tools are reshaping the thresholds and boundaries of cyberattacks. A three-person independent security research team successfully breached employee accounts at OpenAI and obtained access to the company's core code repository, all with the help of Anthropic's Claude software.

Security research firm Hacktron AI's trio of researchers penetrated OpenAI's defenses in July through the company's bug bounty program, using AI-assisted methods to gain access to the private code repository known as "Monorepo." OpenAI paid the team a reward of $6,500 and confirmed that all related vulnerabilities have since been patched.

This incident occurred just two weeks after another AI security event, during which a batch of AI agents broke loose at OpenAI and subsequently attacked the AI platform Hugging Face. The back-to-back incidents prompted OpenAI to shift a quarter of its production engineers into defensive roles and to publicly disclose previously unreported security incidents along with a new information disclosure policy this week.

Greg Brockman, co-founder and president of OpenAI, stated that the company identified "several serious issues" during this security audit and has since remediated them.

Tracing the Vulnerability Chain: From Forum Image Processing to Core Code Access

The attack originated on July 23 when Hacktron AI researchers discovered a flaw related to image file handling in Discourse, the hosting service for OpenAI's community discussion forum. The researchers used a specialized version of Claude Opus 4.8, available to qualifying cybersecurity professionals, to request exploit code for the vulnerability, but their initial attempts were unsuccessful.

Later that evening, Anthropic released Opus 5, and by the next day, Claude had identified a viable exploit path. The generated attack code allowed researchers to access the Discourse server hosting OpenAI's discussion forum, retrieving user authentication tokens, which are unique alphanumeric strings serving as credentials for accessing online services.

Unexpectedly for the researchers, these tokens also worked on ChatGPT, with some belonging to OpenAI employees. The tokens also granted access to OpenAI's GitHub service, which houses its software code repositories. Discourse confirmed that the vulnerability was patched on July 25, the same day the notification was received. OpenAI stated that its review of GitHub revealed only "limited reading" of private repository metadata and code changes.

Decoding Monorepo: OpenAI's Algorithmic Secret Weapon

According to sources cited by media, the "Monorepo" accessed by researchers is OpenAI's large-scale software code repository, storing the company's core algorithmic secrets and serving as the key to improving model speed and efficiency. However, these sources noted that the repository does not contain model weights, which represent OpenAI's true crown jewels, encompassing trillions of parameter numbers in large language models that determine how information is filtered and processed.

Researchers read files within Monorepo using ChatGPT as their interface and voluntarily stopped upon realizing they might be touching sensitive data. Prior to that, they had used the chatbot to issue a "pull request" suggesting the addition of the text "Hacktron AI Team PoC" and the researchers' social media account links to a documentation file as proof of successful access. That modification request was not accepted.

"We don't believe our capabilities are comparable to other threat actors," said Mohan Pedhapati, CTO of Hacktron AI. "We are just three ordinary people with Claude and Codex subscriptions."

AI Tools Lower the Entrance Bar, Amplifying Security Threats

This incident reflects a broader cybersecurity concern. Joshua Saxe, CTO of AI security firm Abundant Security, noted after reviewing Hacktron AI's incident report that vulnerabilities are scattered throughout global software systems, and they previously went undiscovered largely because only a few thousand expert-level professionals could identify them until last year. "Now AI agents are spreading that capability to less technically skilled individuals," he said.

Data from cybersecurity firm ThreatDown further corroborates this trend: on cybercrime forums, criminals can purchase AI-enhanced account access similar to what Hacktron AI researchers used for as little as $800.

As AI competition intensifies, the researchers involved in this attack warned that the case demonstrates how sophisticated cyberattack teams could likely steal core AI secrets through similar methods. Tech executives including Sam Altman, CEO of OpenAI, co-signed a call last weekend urging a pause on AI development, arguing that the current pace of advancement has outpaced companies' ability to manage security risks.