A team of white hat hackers took over OpenAI's private code repository in 72 hours

Key conclusions

White hat researchers from Hacktron AI gained access to a private OpenAI repository on GitHub in less than three days.

The latest Claude Opus 5 AI model from Anthropic was used to create a working exploit for the ARM64 architecture.

Reporting the vulnerability via the Bugcrowd platform earned researchers a $6,500 reward.

A team of white hat security researchers from Hacktron AI gained access to OpenAI’s private code repository in less than 72 hours. They used a combination of three separate vulnerabilities and Anthropic’s Claude Opus 5 language model. The operation ended on July 25, 2026 with a bug report in the Bugcrowd program, for which OpenAI paid a reward of $6,500. The case came to light in mid-September after the material was published in the Wall Street Journal.

The course of the white hat attack on the OpenAI infrastructure

The chain of vulnerabilities began with a bug in the external “libheif” library that handles image files on the Discourse discussion forum used by OpenAI. This vulnerability allowed remote code execution (RCE) on the forum server. In the next step, white hat researchers exploited a flaw in the single sign-on (SSO) process. This allowed them to take over a ChatGPT account belonging to one of the company’s employees.

The account, integrated with the Codex environment, provided direct access to the OpenAI organization on GitHub. The team gained access to the openai/openai repository. To prove its irretrievable presence in the system, researchers created a harmless pull request. In accordance with the principles of ethical hacking, analysts refrained from viewing or copying confidential source code. The bug was fixed by OpenAI on the same day as the report was submitted.

The Claude Opus 5 model created the exploit in a few hours

The most important element of the operation turned out to be the use of generative artificial intelligence to automate the creation of executive codes. The team initially tested using the Claude Opus 4.8 model, but this version did not produce the expected results. The breakthrough came after the implementation of the Claude Opus 5 model, made available on July 24.

The AI took just a few hours to generate a working exploit for the ARM64 architecture. Then, the algorithm efficiently adapted the created code to the x86-64 architecture and the jemalloc memory management mechanism. Preparing this type of scripts using memory corruption has previously required many weeks of work from highly qualified engineers.

The rise of threats based on AI agents in blockchain networks

The use of advanced models to automatically generate attack codes translates directly into the security of digital projects. Chainalysis data shows that criminals are publishing malware instructions on public blockchains 440% more often than last year. The average daily number of malicious writes increased from 2.06 to 11.1.

Analysts linked this jump to the availability of Chinese open-weight models without factory safety locks. This technique, known as “blockchain dead drops”, involves placing control commands directly in immutable registers. In the second quarter of 2026, entities related to the governments of North Korea and Iran accounted for half of the total activity of this type.

Criminal groups such as North Korea’s Kimsuky install local LLM platforms – including Ollama, GPT4All and Msty – directly on their own infrastructure. These tools are used to generate credible phishing messages en masse. Blockaid recorded 212 incidents in blockchain networks with a total value of $1.1 billion.

A team of white hat hackers took over OpenAI’s private code repository in 72 hours

The course of the white hat attack on the OpenAI infrastructure

The Claude Opus 5 model created the exploit in a few hours

The rise of threats based on AI agents in blockchain networks