Three Researchers Used AI to Hack OpenAI for Under $3,000. The Economics of Hacking Just Changed

A few days ago, the headline was already strange enough: security researchers used Anthropic's Claude to help break into OpenAI. Now the story looks considerably more important. The three researchers behind the operation say they went from discovering the vulnerability to reaching an OpenAI internal repository in less than 72 hours, while their broader research project, known as "HEIF Heist," cost less than $3,000 in AI model usage. Even more interesting, the researchers say the same approach could be adapted to other major technology platforms in roughly a day or two. (theverge.com)

That changes the story. This is no longer simply about Claude helping researchers exploit a vulnerability at OpenAI. It is about what happens when artificial intelligence dramatically reduces the time, money and expertise required to conduct sophisticated security research. The researchers were ethical hackers operating within OpenAI's bug bounty ecosystem, meaning they reported the vulnerabilities, stopped after demonstrating access and did not attempt to steal OpenAI's private source code. OpenAI fixed the issues and paid the team a $6,500 bounty. (theregister.com)

But the demonstration itself is difficult to ignore. Three people, AI coding tools and a few thousand dollars were enough to uncover a path that reached one of the most valuable software environments in the technology industry. That does not mean anyone with $3,000 can suddenly break into OpenAI, because the researchers already had substantial cybersecurity expertise and knew what they were looking for. What it does suggest is that AI is lowering some of the costs and technical barriers involved in sophisticated vulnerability research, and that could have major consequences for both attackers and defenders.

It Started With a Forgotten Image Decoder

The original vulnerability was not hidden inside OpenAI's AI models. It was buried much deeper in the software stack. OpenAI's community forum runs on Discourse, and in the affected configuration, HEIF images could pass through ImageMagick and eventually reach the libheif image-decoding library. Hacktron discovered a heap buffer overflow in that processing chain that could be used to achieve remote code execution. (securityweek.com)

The vulnerability was particularly interesting because the underlying issue had reportedly already been fixed upstream, but it had not gone through the normal vulnerability identification process. Because it was not properly classified and tracked, the fix had not necessarily reached every environment using the affected software. That is a classic cybersecurity problem. Software can be patched upstream while vulnerable versions continue to exist somewhere else, and a company might not even realize it is running an affected component because the vulnerable library is buried several layers beneath the application it actually knows it is using.

This is also where AI becomes particularly useful. A security researcher may know that a particular image-processing component is worth investigating, but understanding exactly how it is connected to a large application can take significant time. A capable AI model can help map those relationships, analyze unfamiliar code, explain how a library behaves and generate test cases much faster than a human working alone. The model does not have to discover everything independently for it to create a major productivity advantage.

Claude Helped Turn the Bug Into an Exploit

Hacktron initially used Claude Opus 4.8 while investigating the vulnerability. The model helped the researchers understand the bug and work on an exploit, but their initial attempts did not succeed against OpenAI's configuration. Then Anthropic released Claude Opus 5, and according to the researchers, the newer model was able to help produce an exploit that worked against OpenAI's Discourse environment. (wsj.com)

The timing is one of the most revealing details in the entire story. The vulnerability itself did not suddenly appear when Opus 5 launched, and Claude did not independently discover OpenAI as a target. The researchers already knew what they were investigating and provided the direction. What changed was the model's ability to help them turn that knowledge into a practical exploit.

That distinction matters because it shows where AI's immediate cybersecurity impact is likely to be strongest. The model does not need to replace an expert hacker. It can simply remove some of the technical bottlenecks that slow the expert down. If a researcher can spend less time debugging exploit code, understanding unfamiliar libraries or searching through documentation, the same person can investigate more targets in the same amount of time.

The First Door Was Not the Important Door

Getting remote code execution on the forum was only the beginning. The researchers discovered that the forum's authentication system created another path, allowing them to obtain valid authentication tokens, including tokens associated with OpenAI employees. Those credentials could then be used to access ChatGPT and Codex accounts. (theregister.com)

One of those accounts was connected to OpenAI's GitHub organization, which eventually provided a route into the company's internal development environment. This is a textbook example of why modern security breaches are often about chains rather than individual vulnerabilities. The first weakness does not need to give an attacker everything. It only needs to provide enough access to discover the next weakness, and the next one can lead somewhere more valuable.

The researchers eventually reached OpenAI's internal GitHub repository, known as "Monorepo." According to reporting, the repository contained sensitive internal software and algorithmic material, although the researchers did not browse through or download the private source code. Instead, they demonstrated their access by using the employee's Codex account to submit a benign pull request to the internal repository. (theverge.com)

That distinction is important. This was not a case of researchers stealing OpenAI's model weights or secretly dumping the company's entire codebase. They demonstrated that they could reach the environment and then stopped, which is exactly what a responsible security test is supposed to do. The value of the discovery was proving that the attack chain worked and giving OpenAI enough information to close it.

The Researchers Did Not Need a Huge Team

One of the most striking observations from the research is how small the team was. Hacktron's CTO Mohan Pedhapati told the Wall Street Journal that the group consisted of only three people and argued that they were nowhere near the capabilities of the most sophisticated state-backed cyber organizations. His point was that if a small team can accomplish this with access to modern AI tools, much better-funded attackers have reason to take the technology seriously. (wsj.com)

Cybersecurity has historically been constrained by manpower as much as technology. A sophisticated operation can require vulnerability researchers, exploit developers, programmers, analysts and people capable of understanding the target's infrastructure. AI does not eliminate the need for those skills, but it can allow a small number of skilled people to cover more ground.

That is where the economics begin to change. If three researchers can use AI to investigate a complicated vulnerability chain in days instead of months, then the same researchers can potentially investigate many more systems over the course of a year. A criminal group could theoretically apply the same principle to a much larger pool of targets, while security companies could use it to search for weaknesses before attackers find them.

The $3,000 Question

The most provocative number in this story is not the $6,500 OpenAI bounty. It is the reported cost of less than $3,000 in AI model usage for the broader research project. That number should not be misunderstood. The researchers were experienced security professionals, and the AI subscriptions did not magically transform complete beginners into elite exploit developers.

Still, the cost matters because AI makes experimentation cheaper. A security researcher can afford to test more ideas, analyze more software and investigate more targets when much of the technical workload can be delegated to an AI system. The same is true on the offensive side. A criminal group does not necessarily need to hire a large team of specialists if AI can perform parts of the research process at a fraction of the traditional labor cost.

This is one of the biggest economic changes AI could bring to cybersecurity. The cost of intelligence is falling. Finding information, understanding software and generating technical solutions are all becoming cheaper. That is good news for defenders, but it also means that more attackers can afford to attempt sophisticated research.

The Same Research Could Work Against Other Companies

This is where the story becomes bigger than OpenAI. Hacktron reportedly tested its methodology against technologies and companies including Slack, Meta, GitHub Enterprise, Rails, Next.js and ImageMagick. The researchers said adapting their approach to a different target could take roughly one or two days. (theverge.com)

That does not mean those companies were successfully breached. The researchers were testing whether the methodology could be transferred to different environments, and the reporting should not be interpreted as evidence that all of those companies were compromised. But the ability to move a research technique from one target to another relatively quickly is significant.

Traditionally, every new target can require a large amount of fresh research. Its software stack is different, its authentication architecture is different and its infrastructure is different. AI can potentially reduce the amount of time needed to understand those differences, making vulnerability research more portable.

That could eventually turn security research into something closer to a continuous manufacturing process. Instead of spending months investigating one target, a small team could develop a methodology and then repeatedly apply it across hundreds of systems.

AI Could Turn Vulnerability Research Into a Factory

For decades, security research was largely artisanal. A highly skilled researcher would spend weeks or months understanding a target, studying source code, reproducing crashes, investigating unusual behavior and manually developing an exploit. That work can produce extraordinary results, but it does not scale easily because human researchers have limited time.

AI changes the equation. A researcher can delegate portions of the process to a model while continuing to handle the parts that require judgment. The AI can generate test cases, analyze errors, explain unfamiliar code and explore possible approaches while the human decides which results actually matter.

That means a small team can potentially behave like a much larger team. And if AI agents become capable of operating these workflows with less human supervision, the scale could increase again. The important question for cybersecurity is therefore not whether AI will become a perfect autonomous hacker. It is how much of the existing human workflow can be automated before that level of autonomy is even necessary.

Defenders Get the Same Advantage

There is an obvious positive side to all of this. Everything AI can do for attackers can potentially be used by defenders. Security teams can use AI to inspect code, identify vulnerable dependencies, analyze logs, investigate suspicious behavior, test applications and automate parts of incident response.

In fact, AI could eventually make defensive security significantly more proactive. Instead of waiting for a vulnerability to become public, organizations could have AI systems continuously examining their own infrastructure for weaknesses. Instead of manually investigating every alert, security analysts could have AI agents perform the initial investigation and focus human attention on the most serious cases.

The problem is that defenders face a difficult asymmetry. An attacker only needs to find one viable path into a system, while a defender needs to close every meaningful path. If AI makes vulnerability research ten times faster for both sides, the defender still has the harder job because there are vastly more things that need to be protected.

The Forgotten Library Problem Could Get Worse

The HEIF Heist research also highlights one of cybersecurity's least glamorous but most important problems: software dependencies. Modern applications are built from layers of third-party software, and companies often depend on libraries they did not write and may not even realize are present several layers beneath their applications.

A company might know it uses an image-processing service without knowing exactly which parser that service depends on. A vulnerability in a small library can therefore become part of a much larger application's attack surface. In this case, the problem involving image processing eventually became the first link in a chain that reached much more sensitive systems.

AI can help defenders map those dependencies faster and identify outdated components. But the same capability can help attackers find them faster. The software inventory that tells a security team which library needs to be patched can also tell an attacker where to start looking.

That is why software supply-chain security is becoming increasingly important. AI does not remove the old cybersecurity problems. It makes people better at finding and exploiting them.

The OpenAI Connection Makes This Story Even More Interesting

There is another layer of irony here. OpenAI is one of the companies pushing AI coding agents toward increasingly autonomous software development, and Codex can work with code repositories and development workflows. In this incident, one of the compromised employee accounts had access to Codex, and the researchers used that access to demonstrate that they had reached OpenAI's internal GitHub environment. (theregister.com)

That demonstrates an important security principle for the agentic AI era: an AI-connected account is not just another account. The more tools and permissions an AI system has, the more valuable the identity controlling it becomes.

Companies are increasingly connecting AI agents to source code, cloud infrastructure, internal documents, email and other business systems. Those connections make the agents useful, but they also create potential attack paths. A compromised employee account with access to an AI coding system could potentially provide an attacker with capabilities that go far beyond what the employee could manually do.

That means companies now need to secure not only their employees and applications, but also the AI agents operating on their behalf.

The AI Cybersecurity Arms Race Is Moving Faster

The Hacktron research comes at a time when both Anthropic and OpenAI are reporting increasingly sophisticated AI-assisted cybersecurity activity. Anthropic has disclosed real-world cases in which Claude was used for reconnaissance, exploitation and other parts of cyber operations, while OpenAI has separately studied how increasingly capable models can discover and exploit software vulnerabilities. (wsj.com)

The industry is therefore entering a strange new phase. AI companies are building models that can help people write software, and those same capabilities can help people break software. The companies are then using AI to defend themselves against attackers using AI, while attackers gain access to newer models with every generation.

The cycle is accelerating. A vulnerability that once took a highly skilled researcher weeks to investigate may become a problem that can be explored in a matter of hours. A defensive team that once had days to respond may increasingly face automated systems capable of working around the clock.

What Happens When AI Can Hunt for Vulnerabilities 24/7?

The Hacktron researchers were still in control of the operation. They decided what to investigate, interpreted the results and chose when to stop. But the next generation of AI agents could automate more of those decisions.

Imagine an agent that can continuously monitor public-facing infrastructure, identify technologies, search for known weaknesses, test configurations, analyze failures and prioritize promising targets. It would not need to be smarter than every human cybersecurity expert. It would simply need to work continuously, investigate thousands of possibilities and bring the most promising results to a human operator.

That is the scenario security teams need to prepare for. The danger is not necessarily an AI that suddenly becomes a movie-style hacker. It is an AI that turns cybersecurity research into a scalable process.

OpenAI Was Able to Fix the Problem Quickly

There is an important positive takeaway from the incident. Once Hacktron reported the issue, OpenAI moved quickly. The company reportedly fixed the OpenAI-side vulnerability in roughly 14 hours, revoked affected sessions and tokens and tightened the permissions associated with community sign-in. Discourse also patched its image-processing setup and added additional sandboxing. (theregister.com)

That response is exactly what responsible disclosure is supposed to achieve. Researchers find the weakness, demonstrate the impact, report it to the company and give the company an opportunity to fix it before criminals exploit it.

But fixing the vulnerability does not eliminate the capability that helped discover it. The next target will have a different vulnerability, a different software dependency or a different authentication weakness. What is changing is the speed at which researchers can search for those problems.

That is why the Hacktron story matters even though OpenAI was not catastrophically breached.

The Most Important Number Is Not Zero

There is an easy way to dismiss the incident. OpenAI was not stripped of its model weights. The researchers did not publish the company's private source code. The company fixed the vulnerabilities, and the people who discovered them were acting responsibly.

But cybersecurity is not measured only by the amount of damage that actually occurs. It is also about how easily an attacker can reach the point where serious damage becomes possible.

Hacktron demonstrated that the path existed. They demonstrated it quickly, and they did so using AI as a significant part of the research process. The fact that they stopped and reported their findings is the good news. The fact that the same capability could eventually be used by someone with very different intentions is the problem.

The Economics of Hacking Are Changing

For decades, sophisticated cyberattacks were expensive because expertise was expensive. AI changes that equation by making expertise more productive. A small team can accomplish more, a security company can investigate more targets and a criminal organization can potentially automate more reconnaissance and technical research.

The result probably will not be that attackers suddenly win. Instead, the industry is entering a much faster arms race in which both sides use increasingly capable AI to improve their operations.

That may be more disruptive than a single breakthrough attack.

The HEIF Heist research demonstrates why. Three security researchers used Claude and other AI tools to investigate vulnerabilities, develop an exploit and chain access through multiple systems until they reached OpenAI's internal development environment. They say the operation took less than 72 hours, while the broader research cost under $3,000 in AI usage. (theverge.com)

They were ethical researchers. They stopped. They reported the vulnerabilities. OpenAI patched them.

That is the good news.

The uncomfortable news is that the technology does not care who is holding the keyboard.

AI has made the hacker faster, and it is making the defender faster too. The cybersecurity battle of the next few years may therefore be decided not by who has the smartest individual hacker or the best individual AI model, but by who can search, respond and adapt at the greatest scale.

And that is a much bigger story than one vulnerability at OpenAI.