Three People, 72 Hours and Claude: The Startup That Hacked OpenAI Accounts

A three-person startup, Hacktron AI, broke into OpenAI employee accounts — and the exploit was written by Claude Opus 5, from rival Anthropic. The story, disclosed by the team itself on September 18, 2026, combines everything that defines AI security in 2026: authorized research, an old flaw in an image library, a login mistake and a model capable of turning raw data into an attack in a few hours. Alongside Irregular, the startup whose tests made Gemini, GPT, Claude and Llama “break out,” Hacktron reveals a new niche: tiny companies that make a living testing the giants.

Quick answer: what did Hacktron do?

Harsh Jaiswal, Mohan Pedhapati and Rahul Maini chained two flaws in under 72 hours: a HEIF image upload to OpenAI’s public Discourse forum exploited a heap buffer overflow in the libheif library; and session tokens issued by the forum remained valid on ChatGPT and Codex due to a single sign-on (SSO) weakness. That got them into employee accounts and OpenAI’s internal GitHub environment, where they opened a “harmless” pull request as proof. OpenAI fixed the issue in about 14 hours and paid a $6,500 bounty on September 1. All within an authorized program.

The attack chain, step by step

The detail that rattled the industry

It is not the flaw — libheif’s bug is known. It is the speed: the previous model (Opus 4.8) could not do it; Opus 5 did it within hours, on release day. The distance between “the model cannot” and “the model can” was one version. For defenders, that means the window to patch public vulnerabilities shrinks with every AI release.

Irregular: the other startup in the headlines

If Hacktron attacks, Irregular measures. The startup — valued at $450 million, backed by Sequoia and Redpoint — builds simulated environments to test how far a model can intrude. It was in one of those tests, with a bug that opened the real internet, that Gemini, GPT, Claude and Meta’s model accessed real companies’ systems. Irregular notified all four labs in late July; the staggered disclosures became the AI story of the week.

Why this matters to you

For founders, it is a new, proven market: AI red teaming as a service. It does not require heavy capital — Hacktron has three people — and it has customers who pay well to find out before criminals do. For product teams, the lesson is that an “old bug” remains a risk when a model can exploit it in hours: update image libraries and review SSO tokens that work across more than one system. And for any region short on security talent, startups like these are one of the few fronts where a small team competes with the world on equal terms.

Frequently asked questions

What is Hacktron AI?

A security startup made up of three researchers — Harsh Jaiswal, Mohan Pedhapati and Rahul Maini — who, in an authorized test, reached OpenAI employee accounts and the internal GitHub using Claude Opus 5 to write the exploit.

Was the OpenAI hack a crime?

No. It was authorized research under OpenAI’s bug bounty program; OpenAI fixed the flaw in about 14 hours and paid a $6,500 bounty.

What is Irregular?

An AI security startup, valued at $450 million, that tests models in simulated environments. A bug in its tests led Gemini, GPT, Claude and Meta’s model to access real systems, a case disclosed in September 2026.

At DigitalRadar, we follow the startups reshaping security. Stay on the radar so you do not miss the next one.