The news
Security researchers employed Anthropic’s Claude to take over OpenAI employee accounts and gain entry to a private code repository known as Monorepo. The team, operating under the name Hacktron, completed the work in less than three days and demonstrated access by submitting a pull request from an employee’s Codex account. They halted before reading the repository contents and reported the issues instead.
Context
OpenAI maintains internal systems that include employee ChatGPT accounts and a GitHub repository holding algorithmic material. The researchers reached these assets through Discourse, the third-party forum platform that hosts OpenAI’s public community site. Prior to this exercise, no public reports described AI models being used in this manner to chain together account takeovers against another AI company’s infrastructure.
The three researchers worked independently and drew on publicly available access to the Claude models. Their path began at the community forum and moved into employee accounts tied to ChatGPT before reaching the code repository. The entire sequence stayed within a 72-hour window, after which the team disclosed the findings rather than extracting data.
Details
The three researchers worked with Claude Opus 4.8 and Claude 5. They began by targeting OpenAI staff accounts tied to the company’s ChatGPT service. Once inside an account, they moved laterally to the Monorepo repository. Sources describe Monorepo as containing OpenAI’s algorithmic secrets. The team stopped short of inspecting files and instead created a pull request from the compromised Codex-linked account to prove control. All activity occurred inside a 72-hour window. The researchers then disclosed the chain of vulnerabilities to the affected parties.
The sources differ slightly in emphasis. TechCrunch and Ars Technica focus on the breach of OpenAI systems and the internal repository. The Verge and The Register highlight the use of employee ChatGPT accounts and the Discourse entry point. None of the reports supply additional technical steps or name specific vulnerabilities beyond the high-level path described.
The researchers operated as a small independent group rather than a contracted red-team exercise. They used the models to navigate the sequence of systems without custom tooling beyond what the models themselves provided. After reaching the repository they chose to demonstrate control through the pull request instead of viewing files, then contacted the affected organizations with their findings.
Reactions / counterpoints
No statements from OpenAI or Anthropic appear in the coverage. The reports treat the episode as a completed responsible-disclosure case rather than an ongoing incident. The Wall Street Journal is cited as the original source for several details, including the name Monorepo and the description of its contents, though the four outlets differ in how much weight they give to the AI-assistance angle versus the account-compromise angle.
Why it matters
The episode shows that current frontier models can already serve as practical tools for offensive security work against production systems at peer companies. A small team needed only days and publicly available model access to reach material that OpenAI treats as sensitive. The decision to stop at proof-of-access rather than data exfiltration kept the action within responsible disclosure bounds, yet the same workflow could be applied by actors without that restraint. Companies that rely on AI coding assistants and third-party community platforms now face a narrower margin for unpatched account or integration weaknesses. The Monorepo exposure in particular underscores how a single compromised employee credential can surface core intellectual property when an AI agent handles the navigation. Organizations that treat model access as a productivity feature rather than a potential attack surface will need to reassess how those tools interact with internal authentication flows and external services.
---
Sources:
{"word_count": 682, "expanded_sections": ["Context", "Details", "Why it matters"], "sources_used": 4}
No comments yet