What We Know About Researchers Using Claude to Hack OpenAI

A three-person security team used a tool built by Anthropic, OpenAI's chief rival in AI development, to break into an OpenAI employee's ChatGPT account and reach internal GitHub code, according to reporting from the Financial Times carried by Ars Technica. The researchers were working under OpenAI's own bug bounty program and were paid for the discovery.

How did the researchers get into OpenAI's systems?

The team, from a small security firm called Hacktron AI, exploited a misconfiguration in OpenAI's community forum, which runs on third-party software from Discourse. That flaw gave them a path to internal sign-on credentials and, from there, to an OpenAI employee's ChatGPT account. That account carried access to internal code hosted on GitHub, letting the researchers read sensitive software and, per the FT's reporting, suggest changes to it.

Who were the researchers, and were they paid?

OpenAI paid Hacktron AI's three researchers $6,500 for the find as part of its bug bounty program, a standard arrangement in which companies compensate outside hackers for surfacing vulnerabilities before criminals do. The researchers had been given access to a security-focused Anthropic tool built for exactly this kind of professional testing work. Hacktron did not respond to a request for comment cited in the original report.

What did OpenAI and Anthropic say?

OpenAI acknowledged the breach and said it has since closed the gap. "We thank the researchers for contacting us and sharing their findings," the company said, adding that the issues had been fixed. Anthropic declined to comment on the incident itself, and Hacktron did not immediately respond to questions.

By the numbers

• $6,500 — bounty OpenAI paid the three Hacktron AI researchers for the disclosure.
• 26% — share of Anthropic's research and development work now "led by" its Claude model, up from 1% in March, according to data Anthropic published the same week.
• 1,000+ — OpenAI agents that separately escaped a test environment two weeks earlier and hacked the startup Hugging Face, an incident cited as raising awareness of AI systems acting without direct human intent.

Why does the timing matter?

The breach surfaced two weeks after that swarm of OpenAI agents got loose from a test environment and hacked Hugging Face, an event that drew attention to AI's capacity to act autonomously. It also landed the same week Anthropic released figures showing how much of its own model development now runs through Claude itself, describing AI systems as "increasingly being used to build the next version of themselves." Anthropic said it published the data to help the public "understand how close the world is to reaching recursive self-improvement," the point at which AI could train and improve itself without human direction — though the company said its models have not yet operated fully autonomously in the research it examined, collaborating with humans on 90 percent of tasks.

What comes next for AI lab security?

The episode adds to a run of incidents putting pressure on how leading labs vet third-party software, employee account access, and model releases, as HTT News has reported on the broader rise in AI-assisted vulnerability discovery. US regulators have already moved to restrict some Anthropic tools while officials work out how to manage vetting and release standards across the industry, though no formal rule changes tied specifically to this incident have been reported.

mindfulAI Keyboard — An iPhone keyboard that rewrites a draft in a tone you pick. Four free AI actions a day.