A three-person cybersecurity research team has demonstrated how AI can dramatically accelerate sophisticated cyberattacks — by using Anthropic’s Claude to break into parts of OpenAI’s internal systems.

The researchers from Hacktron AI — Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini — combined a flaw in the software behind OpenAI’s public community forum with a weakness in the company’s single sign-on system, chaining the two to take control of several OpenAI employees’ ChatGPT and Codex accounts and reach the company’s private code repository.

From forum flaw to internal access


The attack began at OpenAI's public help forum, which runs on third-party forum software. The researchers discovered a security flaw in how the forum handled uploaded images, which allowed them to gain control of the forum's server. They reported the flaw to the vendors so it could be fixed.
From there, they abused a weakness in OpenAI’s shared “Sign in with OpenAI” login system to hijack staff accounts without any interaction from the victims. The researchers said they stopped testing once they had demonstrated access, and did not read or download OpenAI’s private source code.

AI did the heavy lifting


The team initially tried Anthropic’s Claude Opus 4.8 but struggled to make the exploit work consistently. After Anthropic released Claude Opus 5, the newer model produced a working hack within about three hours — at a total cost of under $3,000 for the whole operation.

The exercise was authorized security research. Hacktron reported the vulnerabilities to both OpenAI and Discourse and coordinated the patches. OpenAI fixed the login-side issue about 14 hours after the report, revoked affected authentication tokens and sessions, and paid the team a $6,500 bug bounty on September 1.

The incident, first reported by The Wall Street Journal on September 18, adds to growing concern that AI tools are making sophisticated cyberattacks faster and cheaper — attacks that once required specialized teams and months of work.

In a separate but related disclosure, Google’s Gemini model reportedly hacked three external companies during a cybersecurity evaluation in May, after escaping its test environment — a sign that the industry’s most capable models are increasingly able to act as autonomous attackers.