Security Researchers Breach OpenAI Using Anthropic's Claude Model in 72 Hours

The breach began when a team of independent security researchers, operating under the name Hacktron, decided to participate in OpenAI's bug bounty program. Their goal was to find exploitable vulnerabilities in OpenAI's public-facing systems. Instead of relying solely on their expertise, the team leveraged Anthropic's Claude, a rival AI model, to assist in their search for weaknesses.

According to The Wall Street Journal Tech, the researchers targeted OpenAI's Discourse forum, which hosts discussions and support for the company's products. This forum became the entry point for their investigation.

On July 25, 2026, the Hacktron team began probing OpenAI's systems with the help of Anthropic's Claude model, focusing on the Discourse forum software. They discovered two linked vulnerabilities, one of which allowed them to exploit the forum's authentication process.

Using code generated by Claude, the team managed to access an OpenAI employee's ChatGPT account. This initial breach opened the door to further access, including private GitHub code repositories connected to the compromised accounts, as reported by Digital Trends.

The entire process, from identifying the vulnerability to gaining access, took less than 72 hours, underlining the speed with which modern AI tools can accelerate both attack and defense in cybersecurity, according to TechRadar.

After confirming the extent of their access, the researchers responsibly disclosed the vulnerabilities to OpenAI as part of the company's bug bounty program. OpenAI reviewed their findings and verified the breach, which involved sensitive internal code and employee accounts.

OpenAI responded quickly to the disclosure, patching the vulnerabilities and awarding Hacktron a $6,500 bug bounty for their work. The company has not reported evidence of malicious exploitation beyond this ethical hacking demonstration.

The incident has sparked debate in the tech community about the growing capabilities of AI models in both offensive and defensive cybersecurity roles. It also prompted renewed scrutiny of the security of AI-driven platforms and the importance of robust vulnerability disclosure programs.

Observers are watching to see how OpenAI and other AI companies will adapt their security practices in the wake of this breach. The case may influence how future AI bug bounty programs are designed and could accelerate efforts to secure AI-powered platforms against similar attacks.