Cybersecurity concerns grow: How Claude was used to hack OpenAI, weeks after its own agents attacked Hugging Face

A team of just three researchers achieved an unprecedented feat in the field of cybersecurity: using Claude, Anthropic's artificial intelligence model, to infiltrate the internal systems of its commercial "archrival," OpenAI.

As revealed by The Wall Street Journal, hackers gained access to a company employee's ChatGPT account and, from there, were able to read and even suggest changes to the private software repository where OpenAI stores much of its algorithmic secrets.

The discovery comes just two weeks after a swarm of OpenAI agents went out of control and hacked the platform on their own Hugging Face, in one of the most talked-about security incidents of the year within the industry. This time, however, the roles were reversed, with OpenAI becoming the victim.

It all began on July 23, when the team at Hacktron AI—a cybersecurity firm participating in a OpenAI—an authorized space where external researchers can attempt to breach the company's systems in exchange for a reward if they find actual vulnerabilities—detected an issue in the way Discourse, OpenAI's community forum, processed certain image files. The researchers had access to a special version of Claude reserved for industry professionals, and they asked it to write code capable of exploiting that flaw. The first attempt failed. That same night, Anthropic released a new version of its model, and by the next day, Claude had already figured out how to do it.

Using that code, the researchers broke into the server hosting OpenAI's forums and accessed user authentication tokens. Some of those tokens, to the team's own surprise, also worked on ChatGPT and belonged to company employees, reported the WSJ.

From there, they ended up inside Monorepo, the massive repository where OpenAI stores much of its software architecture. They didn't manage to access the model weights—the most sensitive part of any AI system—but they did manage to read internal files and submit a change request to a document, signed by their team, as proof that they had been there.

OpenAI confirmed the discovery and stated that it has already fixed the two vulnerabilities involved. “We thank the researchers for contacting us and sharing their findings. We narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions,” said the company, which paid the team a $6,500 reward for the report. Anthropic, when asked about the incident, declined to comment.

What most concerned the researchers themselves was not so much what they achieved, but how easy it turned out to be.

"I don't think we are as strong as Chinese threat actors," said Mohan Pedhapati, chief technology officer at Hacktron AI. "We're just three guys with Claude and Codex subscriptions." That sums up the underlying fear running through the entire industry, where a handful of independent researchers managed, using commercial tools, to achieve something significant—and perhaps insignificant—for any state-backed group with real resources.

A year marked by Hacks, resignations, and warnings

This episode adds to a string of events that have been rocking the sector for weeks. In July, hundreds of OpenAI agents carried out the attack on Hugging Face without the company's knowledge, in what ended up becoming the first major documented case of a hack executed autonomously by artificial intelligence systems. Shortly thereafter, more than 130 technology companies, including OpenAI, Anthropic, Google, and Microsoft, signed an open letter warning that a wave of AI-powered cyberattacks is on the horizon and calling for urgent measures to strengthen protection for hospitals, water treatment plants, and other critical infrastructure.

The concern wasn't limited to the corporate sector. The U.S. National Security Agency warned about Chinese companies allegedly extracting capabilities from U.S. AI models using "distillation" techniques, a practice that erodes the technological advantage Washington seeks to maintain over Beijing. During that same period, two researchers—one currently at Anthropic and another formerly at OpenAI—caused a stir by publicly stating that they considered it a real possibility that artificial intelligence could end up posing an existential risk to humanity within the next decade.

Meanwhile, the commercial race continued unabated. OpenAI unveiled GPT-6 Astra, its most advanced model to date, claiming to have surpassed Anthropic in performance. And Sam Altman, its CEO, began meeting with U.S. electric utilities to offer them AI-powered cybersecurity protection, just months after his company's own agents were involved in one of the biggest security incidents the industry has faced to date.