Three Indian Researchers Used Claude to Breach OpenAI Systems in Under 72 Hours: Three Indian cybersecurity researchers have shown just how quickly artificial intelligence is changing the way security researchers find and test vulnerabilities.
Researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini from cybersecurity company Hacktron AI—with Jaiswal and Maini publicly associated with Dubai, UAE, and Pedhapati, originally from Rajahmundry, Andhra Pradesh, reported as being based in Hyderabad, India—discovered and chained vulnerabilities that allowed them to demonstrate access to OpenAI employee ChatGPT and Codex accounts and, ultimately, access to an internal OpenAI software repository.
What makes the story particularly striking is the role played by Claude, Anthropic’s AI model. The researchers used Claude throughout parts of the investigation, including vulnerability analysis, exploit development and adapting their work to the target environment.
The entire exercise moved remarkably quickly. According to Hacktron’s account, the researchers went from their initial breakthrough to demonstrating access to an OpenAI internal repository in less than 72 hours. OpenAI subsequently fixed the vulnerabilities and awarded the team a $6,500 bug bounty.
It Started With an Image Upload
The research began with something that might seem relatively ordinary: uploading an image to OpenAI’s public community forum.
The forum runs on Discourse, and the researchers began looking at how it handled HEIC and HEIF image files. Their investigation led them to the image-processing software used by the platform and, more specifically, to the libheif library.
The researchers found a vulnerability in the way certain HEIF files could be processed. With further work, they were able to turn the vulnerability into a way of executing code on the server.
This was where Claude became particularly useful.
Hacktron said the researchers first asked Claude Opus 4.8 to help investigate the vulnerability and develop an exploit. The model struggled to produce a reliable exploit against the security protections in their environment.
When Claude Opus 5 became available, the researchers tried again.
This time, according to Hacktron, the model was able to produce a working exploit in their local testing environment within hours. The researchers then worked with Claude to adapt the exploit to the specific technical environment they were studying.
That combination of human expertise and AI assistance dramatically shortened the research process.
From Forum Vulnerability to Employee Accounts
Finding a vulnerability was only the beginning.
The researchers discovered that the compromised environment could potentially be connected to OpenAI’s authentication infrastructure. Their investigation identified a weakness involving OpenAI’s single sign-on system.
The two issues could then be chained together.
In simple terms, one vulnerability provided a way into the forum environment, while the authentication weakness opened a potential route toward active OpenAI accounts.
Hacktron reported that the researchers were ultimately able to demonstrate access involving employee ChatGPT and Codex accounts.
Rather than taking sensitive information, however, the researchers focused on proving that the access was real.
The Pull Request That Proved the Access
One of the most revealing parts of the research was what the team did once it reached OpenAI’s internal development environment.
According to Hacktron, an affected employee’s Codex account had access to OpenAI’s GitHub organisation. The researchers used that access to have Codex create a harmless pull request in OpenAI’s internal monorepository.
The researchers identified the proof-of-concept as PR #1186742.
They then stopped.
The objective was not to steal OpenAI’s code or obtain sensitive company information. It was to demonstrate that the vulnerability chain could reach an internal development system.
Hacktron said OpenAI later confirmed that the relevant issues had been addressed.
The Researchers Moved Fast
The timeline illustrates how quickly AI-assisted security research can progress.
On July 25, the Hacktron team reported obtaining remote code execution and administrative access to the Discourse environment hosting OpenAI’s community forum.
The researchers submitted their findings to OpenAI’s bug bounty programme later that morning.
By the afternoon, they had demonstrated the potential impact by creating the harmless internal pull request.
According to Hacktron, OpenAI confirmed that its side of the vulnerability had been fixed later that same day.
The researchers also reported the underlying Discourse vulnerability separately to Discourse through HackerOne. Hacktron said a fix was subsequently prepared, along with additional sandboxing around image processing.
OpenAI awarded the researchers $6,500 for the OpenAI-side finding.
Claude Did Not Simply “Hack OpenAI”
The headline surrounding the story can make it sound as though Claude independently decided to attack OpenAI.
That is not what happened.
The research was carried out by human cybersecurity professionals who chose what to investigate, interpreted the results, tested the vulnerabilities and decided what actions to take.
Claude was a powerful assistant in that process.
It helped the researchers understand technical problems, write and adapt exploit code and work through difficulties that might otherwise have taken substantially longer.
That distinction matters because the real story is arguably less about an AI suddenly becoming a hacker and more about what a small team of skilled researchers can accomplish when advanced AI is added to their toolkit.
A Bigger Story Than OpenAI
The researchers say their work also points to a much wider cybersecurity issue.
The vulnerability they investigated involved libheif, an image-processing library used across a range of software. Hacktron’s broader research examined how the library is incorporated into different applications and technology ecosystems.
That means the underlying security lesson extends beyond OpenAI.
Any organisation that accepts user-uploaded HEIC, HEIF or related image formats needs to understand exactly how those files are processed and whether the underlying software has received the necessary security updates.
The episode is a reminder that vulnerabilities in seemingly ordinary components—such as an image library—can sometimes become the starting point for much more serious security problems.
AI Is Changing the Speed of Cybersecurity
Perhaps the most important takeaway is the speed.
Security research traditionally involves a great deal of trial and error. Researchers need to understand unfamiliar software, identify weaknesses, develop proof-of-concept code and then adapt that code to a particular environment.
AI can now assist with many of those steps.
Hacktron said its broader HEIF Heist research project involved three researchers over roughly two months and cost less than $3,000 in AI-token expenditure.
That does not mean AI has eliminated the need for cybersecurity experts. Quite the opposite: the OpenAI exercise demonstrates the continuing importance of experienced researchers who know what questions to ask, understand the results and operate within appropriate testing boundaries.
But AI can make those experts considerably faster.
A New Reality for Security Teams
For companies building AI systems, cloud platforms and increasingly automated software environments, the challenge is becoming more complicated.
The same technology that can help a security team find a vulnerability can potentially help someone else develop an exploit more quickly.
At the same time, organisations can use AI for defensive purposes—to review code, identify weaknesses, monitor systems and help security teams respond to threats.
The Hacktron research therefore offers a glimpse into a changing cybersecurity landscape.
The most important development may not be that Claude helped researchers find a way into OpenAI. It may be that three researchers were able to combine their own expertise with an AI system and accomplish, in a matter of days, work that could previously have required considerably more time.
As AI models become more capable, that balance between human judgment and machine-assisted capability is likely to become one of the defining issues in cybersecurity.
