Hacktron researchers used Anthropic’s Claude to breach OpenAI GitHub 'Monorepo' in under 72 hours

Topic: technologyRegion: north americaUpdated: i2 outletsSources: 5Spectrum: Center Only⏱ 2 min read

📰 Scored from 2 outletsacross 2 Center How we score bias →

Story Summary

SITUATION

Three independent security researchers at Hacktron used Anthropic’s Claude Opus 4.8 and 5 to compromise OpenAI employee accounts and access OpenAI’s GitHub repository “Monorepo” in less than 72 hours (per The Verge). They stopped short of accessing internal code themselves, instead sending a pull request and disclosing the vulnerability (per The Verge).

Coveragetap to expand ▾

Spectrum: Center Only🌍US: 1 · Other: 1

Political Spectrum

Position is inferred from coverage mix.

i2 outlets · Center

Left

Center

Right

Left: 0

Center: 2

Right: 0

Geography Coverage

Distribution of where coverage is coming from.

i2 unique outlets · Dominant: US/Canada

All2 US/CA1 · 50%Global1 · 50%

KEY FACTS

The researchers accessed OpenAI’s GitHub repository called “Monorepo” within a period of less than 72 hours (per The Verge)
The Wall Street Journal reported on the breach that The Verge summarized in its account (per The Verge)

HISTORICAL CONTEXT

The immediate backdrop is the wider US–Israel campaign against Iran that began with coordinated strikes in March 2026, which Washington and Jerusalem said they carried out after citing intelligence of imminent threats and a pattern of attacks by Iran-linked forces against regional infrastructure and allied assets.

Structurally, that campaign sits atop decades of sanctions and diplomatic ruptures that have shaped technology and national-security policy: the US withdrawal from the Iran nuclear deal (JCPOA) on May 8, 2018, the consequent reimposition of broad sanctions, and successive US executive actions tightening export controls and cyber authorities.

Brief

Three independent security researchers at Hacktron used Anthropic’s Claude Opus 4.8 and 5 to compromise OpenAI employee accounts and gain access to OpenAI’s internal GitHub repository, called “Monorepo,” in under 72 hours, The Verge reports.

According to The Verge’s account of reporting by The Wall Street Journal, the researchers stopped short of browsing or exfiltrating internal source code; instead they submitted a pull request and disclosed the vulnerability they discovered.

The account names Anthropic’s Claude models as the automation the researchers relied on to compromise accounts and escalate access, and it describes the team as independent operators affiliated with Hacktron, a detail repeated in the coverage (per The Verge).

OpenAI’s Monorepo houses centralized code and tools for the company’s projects; The Verge notes the researchers gained access to that repository rather than to isolated external assets (per The Verge).

The disclosure route the researchers took—sending a pull request rather than downloading code—frames the incident as a security proof-of-concept and responsible disclosure rather than an exploit for public exposure, according to the reporting (per The Verge).

This episode raises immediate questions about how generative AI assistants can be weaponized in account-takeover workflows and whether internal defenses and employee account protections at major AI firms are keeping pace with attacker tooling, a concern underscored by the quick timeline from initial access to repository entry (per The Verge).

Why it matters

Concrete costs fall on OpenAI employees and the company’s code integrity: compromised employee accounts enabled access to the Monorepo, exposing internal development assets (per The Verge).
The mechanism of harm is automation-assisted account takeover: Anthropic’s Claude models were used to perform steps that human attackers previously executed manually, reducing time-to-access to under 72 hours (per The Verge).
Security researchers and incident response teams benefit from clearer disclosure norms: Hacktron’s choice to send a pull request and disclose suggests a path for proof-of-concept reporting rather than opportunistic theft (per The Verge).
Anthropic and other AI model providers face reputational and product-risk costs because their models were used as operational tools in the compromise (per The Verge).

What to watch next

Whether OpenAI publicly details the scope of repository access or employee accounts affected in a follow-up disclosure by a specified date, and what remediation steps it takes (per The Verge).
Whether Anthropic publishes a response about Claude Opus 4.8 and 5 model safeguards or alters access controls or usage policies in the coming weeks (per The Verge).
Whether Hacktron or the three named researchers publish technical write-ups or proof-of-concept code explaining the exact workflow they used to compromise accounts (per The Verge).
Whether security vendors or GitHub change recommended controls for enterprise repositories (for example, forced multifactor authentication or internal repo segmentation) after this incident is disclosed (per The Verge).

Where sources differ

7 dimensions

Framing differences

Only The Verge (summarizing The Wall Street Journal) frames the event as both a successful breach and a responsible disclosure; no alternative framing appears in the single source provided (per The Verge).

Disputed or unclear

No source disputes the core facts, but details about which specific employee accounts were compromised and whether any credentials or tokens were exfiltrated remain unclear (per The Verge).

Omitted context

No source in this pack identifies the precise attack techniques or defensive gaps exploited (e.g., MFA bypass, OAuth token abuse) that would explain how Claude enabled the compromise.
No source names which OpenAI teams or codebases inside Monorepo were reachable or whether production systems were exposed.
No source mentions any legal or regulatory actions, bug-bounty payouts, or follow-on investigations by authorities related to the incident.
No source describes Anthropic’s or OpenAI’s prior security posture or specific mitigations that succeeded or failed during the incident.

Conflicting figures

The only numeric figure reported is the timeline: 'less than 72 hours' for access to Monorepo (per The Verge).

Disputed causality

The Verge states the researchers used Anthropic’s Claude to carry out the compromise; no source attributes a prior triggering action that led to the researchers’ operation beyond their decision to test the models (per The Verge).

Attribution disputes

The Verge attributes the reporting to The Wall Street Journal and presents Hacktron researchers as the actors who executed the breach using Anthropic’s Claude models (per The Verge).

Sources

5 of 5 linked articles