Security researchers used Claude to break into OpenAI's internal code repository

Three security researchers used Anthropic's Claude Opus 5 to break into OpenAI's internal code repository last summer, according to reporting by the Wall Street Journal published this week. The team exploited a vulnerability in Discourse — the forum software that powers OpenAI's community platform — and had Claude generate the exploit code that ultimately opened the door to staff authentication tokens and, from there, OpenAI's private GitHub infrastructure.

How they got in

The researchers spotted a flaw in OpenAI's Discourse installation and used Claude to write working exploit code targeting the bug. That exploit captured authentication tokens sitting on the Discourse server. Crucially, some of those tokens also worked on ChatGPT itself, and a subset belonged to real OpenAI employees — giving the team a foothold inside OpenAI's production environment.

With those employee credentials, the researchers were able to browse files inside a repository OpenAI internally calls "Monorepo," which reportedly houses a significant portion of the company's technical codebase. The team did not access model weights, and the Wall Street Journal found no evidence that customer data was compromised or that any changes reached production systems.

Reported privately, patched quietly

The researchers disclosed the vulnerability to OpenAI privately in July 2026 through the company's bug bounty program. OpenAI patched the Discourse flaw, revoked the exposed tokens, and paid the team a $6,500 bounty. The remediation appears to have been thorough: no follow-on exploitation was reported before or after the patch.

The real lesson is about AI-assisted offense

What makes this incident significant is not the sophistication of the underlying bug — Discourse vulnerabilities are not rare — but the role Claude played in weaponizing it quickly. The same capabilities that make large language models useful for debugging code make them effective at writing exploit code: they can search, iterate on payloads, and preserve context across a multi-step attack chain in ways that compress what used to take days of manual work into hours.

The incident is also a reminder that AI safety is not purely a question of what a model will refuse to do. Authorization controls, repository permissions, and network segmentation are the actual last line of defense once an AI-assisted attacker is inside a system's perimeter. The researchers reached OpenAI's internal GitHub not because Claude had special capabilities, but because authentication tokens for a community forum also unlocked employee GitHub access — a credential design problem that no alignment technique would have caught.

OpenAI did not comment on the details of the incident beyond confirming the bounty payment. Anthropic similarly declined to comment on Claude's role in the research.