Hacktron researchers used Anthropic's Claude to breach OpenAI's GitHub in under 72 hours

A three-person security team at the firm Hacktron says it broke into OpenAI employee accounts and reached an internal code repository in under three days, using Anthropic's Claude Opus 4.8 and 5 to help plan and carry out the attack. The Wall Street Journal first reported the findings, which The Verge also covered. The target was OpenAI's GitHub repository known internally as "Monorepo," said to hold algorithmic secrets central to the company's models.

The reported timeline is the part likely to unsettle security teams. Hacktron's researchers claim the intrusion took fewer than 72 hours from start to finish, a pace that would have been implausible for a small independent crew working manually against a company of OpenAI's size and profile just a few years ago. Claude Opus 4.8 and 5, Anthropic's most capable models, were used as force multipliers across the operation rather than as a single trick, according to the account.

The specific prize — the Monorepo — matters as much as the breach itself. A monorepo is a single repository holding code for many projects, and at an AI lab it can concentrate training pipelines, model configuration, evaluation harnesses and internal tooling in one place. If the Hacktron account holds up, the incident raises hard questions about how much of an AI developer's competitive edge sits behind a login that a motivated attacker can reach.

There is also an awkward competitive dimension. Anthropic and OpenAI are direct rivals in frontier model development, and the tool reportedly used to help breach OpenAI's systems was Anthropic's. That does not imply Anthropic endorsed or directed the attack — Hacktron is described as an independent security research team — but it will color how the story is read inside both companies and among their customers.

The disclosure lands as AI labs face growing scrutiny over their own security posture, even as they sell tools marketed on their ability to defend networks. Attackers gaining model-assisted speed against AI companies inverts the usual pitch that frontier systems favor defenders. Neither OpenAI nor Anthropic has publicly detailed its response to the Hacktron claims, and the Journal's reporting leaves open how much access was actually obtained and whether data left the environment.

What to watch next is verification and scope: whether OpenAI confirms the intrusion, whether customer or partner data was touched, and whether the Monorepo exposure was contained to code. Security researchers will also want to know which parts of the operation Claude drove — reconnaissance, credential handling, or exploitation — because that detail shapes how every other AI company budgets its defenses. For now, the headline is a small team, a short window, and a rival's model in the middle of it.