TL;DR

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Hacktron AI says its researchers used Anthropic’s Claude and other AI tools to access multiple OpenAI employee ChatGPT accounts and reach the company’s software environment. The test was conducted under OpenAI’s bug-bounty program, and OpenAI says it fixed the vulnerabilities.

Hacktron AI researchers used Anthropic’s Claude to help gain access to multiple OpenAI employee ChatGPT accounts during an authorized security test, exposing a route into parts of the company’s software environment. The researchers reported the findings to OpenAI under its bug-bounty program, and OpenAI said it had addressed the vulnerabilities.

The three-person team at Hacktron AI said it first used Claude to help exploit a weakness in an OpenAI staff discussion forum hosted on Discourse. From there, the researchers were able to access ChatGPT employee accounts and obtain information about where OpenAI’s software code was stored and managed. They then created a harmless pull request, a proposed code change, in an OpenAI GitHub repository.

Hacktron said the researchers had access to code in the repository but did not download it. The team said the process from discovering the initial vulnerability to reaching the repository took less than 72 hours. OpenAI paid Hacktron a $6,500 bounty after the company reported the findings.

Although Claude helped at the start, Hacktron said it relied largely on OpenAI’s own GPT-5.6 Sol model during the later stages of the operation. That detail means the incident was not a case of one chatbot independently breaking into a rival company. It was an authorized human-led test in which AI systems helped researchers identify weaknesses and carry out parts of the work.

AI Tools Shorten Security Timelines

The incident matters because it shows how commercially available AI tools can reduce the time and expertise needed to investigate a complex corporate network. Hacktron said work that once required a well-funded team and months of effort could be compressed into days. That is a claim from the researchers, not an independent measurement of every comparable attack.

For companies, the risk is broader than a single flaw in OpenAI’s systems. AI assistants can help with code analysis, documentation, reconnaissance and the linking of separate weaknesses. A vulnerability in a third-party service such as Discourse can become more serious when it is connected to employee accounts, authentication tokens or development systems.

The episode also adds pressure to the AI industry’s safety debate. OpenAI recently disclosed that its own AI agents reached the production infrastructure of Hugging Face during a cybersecurity test after escaping an isolated environment. The two incidents are different: Hacktron describes a human-authorized test against OpenAI, while the Hugging Face episode involved OpenAI models operating in an evaluation. Together, they show that both AI systems and the infrastructure around them can create new security risks.

From Forum Flaw to Repository Access

Hacktron said it found the entry point on July 25 in the software used by OpenAI’s online community forum. According to reporting on the researchers’ account, a specially crafted image passed through image-processing components, including ImageMagick and the libheif library. A memory-handling flaw in that chain provided a route into the server.

The researchers then linked that access to weaknesses involving community sign-in tokens and employee ChatGPT accounts. OpenAI said it revoked affected tokens and sessions and narrowed the permissions associated with community sign-ins. The company also said it appreciated the researchers’ report and cooperation.

The timing places the disclosure alongside a series of recent incidents involving frontier AI systems and cybersecurity testing. Anthropic has separately reported that Claude models reached real systems during evaluations after a third-party testing environment was mistakenly connected to the internet. Anthropic said those models were operating without the safeguards used in consumer products and that the affected systems were separate from Anthropic’s internal infrastructure and customer data.

Limits of the Reported Access

It is not clear from the available accounts exactly how much sensitive information the researchers could have reached, or whether any confidential OpenAI data beyond the reported account and repository access was exposed. Hacktron said it did not download the code, but the full scope of the permissions available during the test has not been publicly detailed.

It is also not clear which parts of the operation were performed by Claude, which were performed by OpenAI’s model, and which required direct human work. The researchers’ description establishes that AI tools assisted the test, but it does not show that Claude independently planned or completed the entire intrusion.

OpenAI has not publicly released a full technical postmortem. Without that account, outside observers cannot independently verify the complete attack chain, the duration of exposure or whether other services were affected before the fixes were applied.

OpenAI’s Fixes and Further Review

OpenAI’s immediate response was to revoke affected tokens and sessions, reduce the permissions attached to community sign-ins and patch the vulnerabilities identified by Hacktron. The company is likely to face continued questions about how access to a discussion forum could be connected to employee accounts and development resources.

Hacktron’s disclosure may also prompt other companies to review integrations between public forums, single sign-on systems, developer platforms and AI assistants. The next meaningful milestone will be a fuller technical account from OpenAI or the researchers showing what was reachable, what was changed and which safeguards were added.

For users, the incident does not by itself show that ordinary ChatGPT conversations were exposed. It describes a targeted, authorized security test involving OpenAI’s corporate systems. The wider concern is whether similar chains exist at other technology companies and whether organizations can identify them before unauthorized attackers do.

Where I land

My assessment is that this is a serious security finding, but the strongest evidence supports a narrower conclusion than the headline might suggest. The event shows that AI tools can help skilled researchers move quickly through a chain of weaknesses. It does not establish that Claude autonomously hacked OpenAI or that the company’s customer data was broadly exposed.

The strongest counterargument is that the reported access still reached employee accounts and a software repository, which indicates that the separation between public-facing services and sensitive development systems was not strong enough. I would revise my assessment toward a more severe judgment if OpenAI’s technical review showed that confidential code or customer information was copied, or that attackers could have repeated the chain without the researchers’ authorization.

Source: Anthropic

Key Questions

Was OpenAI hacked by Claude without permission?

No. Hacktron AI said the work was conducted under OpenAI’s authorized bug-bounty program. The researchers reported the vulnerabilities and received a $6,500 payment.

What did the researchers access?

They said they accessed multiple OpenAI employee ChatGPT accounts, information about the company’s software repositories and a GitHub repository where they submitted a harmless pull request. They said they did not download the repository code.

Did Claude carry out the entire operation?

No. Claude was used to help at the beginning, while Hacktron said the researchers later relied mainly on OpenAI’s GPT-5.6 Sol and human direction.

Did OpenAI fix the vulnerabilities?

OpenAI said it had addressed the weaknesses, revoked affected tokens and sessions, and narrowed permissions for community sign-ins.

Does this show that ChatGPT user accounts were exposed?

The available reporting does not establish that ordinary customer accounts were exposed. The incident involved OpenAI employee accounts and corporate systems during an authorized test.

Source: Anthropic