A small security startup has shown how far AI-assisted hacking has come, using one AI company’s model to break into another.
Researchers at Hacktron AI used Anthropic’s Claude to gain access to the ChatGPT and Codex accounts of several OpenAI employees, and from there reached OpenAI’s internal code repository on GitHub. The team, Harsh Jaiswal, Mohan Pedhapati and Rahul Maini, disclosed the work this week after first reporting it to OpenAI in July. The Wall Street Journal reported it on 18 September.
How They Got In
The attack chained two separate weaknesses.
The first was a memory flaw in image-processing software used by Discourse, the platform running OpenAI’s public community forum. Exploiting it let the team run code on OpenAI’s forum server.
The second was in OpenAI’s own login system. According to Hacktron, the token-reuse problem sat in OpenAI’s identity infrastructure, not in Discourse, which meant the forum was only an entry point. Any other OpenAI service connected to the same single sign-on could have played that role.
Combined, the two flaws let the team take over the accounts of active forum members who were OpenAI staff, without those employees doing anything. The full path took less than 72 hours.
What They Did, and Didn’t Do
One compromised employee’s Codex account was connected to OpenAI’s GitHub organisation. To prove the level of access without reading anything sensitive, the researchers prompted that Codex account to open a pull request in OpenAI’s internal repository, named openai/openai.
That was the only action taken. Hacktron says it did not read source code, merge or ship anything, or touch customer data. What the chain could theoretically have reached was far larger, since employees connect ChatGPT and Codex to other tools, potentially including GitHub, Slack and email. That wider access existed but wasn’t used.
How Claude Was Involved
The researchers first tried Claude Opus 4.8, which struggled across several sessions to produce a working exploit. When Anthropic released Opus 5, they tried again and succeeded. They used a special version of Claude that Anthropic makes available to qualified cybersecurity practitioners.
Claude also refused at one point. According to Hacktron’s own write-up, the model declined to write an exploit for a remote target. The team got around this by pointing it at their own copy of the forum software, set up to look like a capture-the-flag practice target, and then used the resulting exploit against OpenAI’s live forum.
OpenAI’s Response
OpenAI fixed the issue about 14 hours after the report and paid the team a $6,500 bounty through its Bugcrowd programme on 1 September. The company said the award covered the flaw on OpenAI’s side, not the actions against Discourse, since testing the forum software itself fell outside the bounty’s scope.
Why It Matters
The researchers’ own summary is the headline. Work that once required a well-resourced team and months of effort can now be compressed into days, they told The Guardian, and each new model is more capable than the last.
