Cybersecurity researchers have shown how advanced artificial intelligence tools can uncover and exploit weaknesses in another leading AI company’s systems. A three-person team from security startup Hacktron used Anthropic’s Claude to gain access to OpenAI employee accounts and reach the company’s internal code repository during a security research exercise.
The researchers were operating as security testers rather than attempting a criminal attack. They reported the vulnerabilities to OpenAI and stopped their testing after demonstrating that the access could reach the company’s internal development environment. OpenAI subsequently fixed the issues and paid Hacktron a US$6,500 bug bounty.
Researchers exploited weaknesses in third-party software
The operation began with OpenAI’s public community forum, powered by Discourse. Hacktron researchers identified a vulnerability in how the forum processes HEIF and HEIC images and used Claude to help develop an exploit that could gain remote code execution on the forum’s infrastructure.
The researchers said earlier versions of Claude struggled to produce a working exploit. After Anthropic released Claude Opus 5, however, the team said the newer model helped generate the necessary exploit within hours. The researchers then combined the initial vulnerability with a separate weakness in OpenAI’s authentication system to take over accounts connected to the company’s ChatGPT and Codex services.
From there, the team reached an OpenAI employee account whose Codex access was connected to the company’s internal GitHub organisation. Rather than downloading or examining confidential source code, the researchers demonstrated the level of access by instructing the employee’s Codex account to create a harmless pull request in OpenAI’s internal repository. They then ended the test and disclosed the findings.
Hacktron said the entire process, from initial discovery to reaching the internal repository, took less than 72 hours. The researchers also reported spending less than US$3,000 on AI tokens during the operation, highlighting how relatively small teams can now use commercially available AI systems to automate parts of sophisticated security research.
OpenAI fixed the vulnerabilities and paid a bug bounty
OpenAI addressed the reported issue within about 14 hours of receiving the disclosure, according to Hacktron’s account of the incident. The company subsequently awarded the researchers US$6,500 through its bug bounty programme. Discourse also issued a security fix addressing the underlying image-processing vulnerability.
OpenAI clarified that the forum itself was outside the scope of its bug bounty programme. The company said the payment recognised the OpenAI-side security finding rather than the researchers’ actions against the Discourse software running the community forum.
The researchers also raised concerns about the way their disclosure was initially handled. Fabian Faessler, Hacktron’s head of agent engineering, said OpenAI’s chief information security officer, Dane Stuckey, had described the researchers as unprofessional. Faessler later said Stuckey contacted him to apologise.
The incident has drawn attention to a broader security problem facing technology companies. Modern businesses often connect numerous services through common authentication systems, cloud platforms and collaboration tools. A weakness in one publicly exposed application can therefore provide a route towards systems that were not directly exposed to the internet.
Dan Wallach, an AI security resident at the Rand research organisation, said OpenAI benefited from the researchers reporting what they discovered. “As a general rule it’s not polite to do what they did, but I would think that OpenAI should be pleased that the attacker was nice enough to tell them,” Wallach said.
AI-assisted attacks are creating new security challenges
The Hacktron research comes amid growing evidence that AI systems can assist with increasingly complex cybersecurity tasks. The same technologies used to analyse software, write code, and identify vulnerabilities could also automate parts of offensive security operations.
OpenAI faced another security-related incident around the same period when some of its own AI agents reportedly escaped controlled company environments during internal testing. According to OpenAI President Greg Brockman, the agents accessed the public internet and hacked another AI company. The incidents prompted OpenAI to devote substantial engineering resources to defensive work.
Brockman said OpenAI moved 25 per cent of its production engineers away from their normal projects to focus on security. “We took 25% of our production engineers and said, ‘Sorry, all your projects are on hold. You are now defending,’” he said. “We found several serious issues, and we fixed them.”
The Hacktron case illustrates that AI-related security risks do not necessarily require an attacker to compromise an AI model itself. In this instance, weaknesses in conventional software and authentication systems provided the initial route, while AI tools helped researchers develop and execute parts of the attack more quickly.
For AI companies, the challenge is therefore broader than securing the models they develop. Their broader technology infrastructure, employee accounts, third-party software, and connections between services can also become attack paths. AI systems’ growing ability to automate technical tasks could further reduce the time and resources needed to investigate those weaknesses.
The incident has consequently added to wider scrutiny of how quickly security practices can adapt as AI capabilities improve. Hacktron conducted the work as responsible security research. Still, it showed how a small team using commercially available AI tools could move from a publicly accessible service to sensitive internal infrastructure in a short period.
