- Published on
White-hat hacker uses Anthropic Claude to breach OpenAI ChatGPT account, earns $6,500 bounty
- Authors
- Name
- DeepHorus
Independent security researchers, using Anthropic's AI model Claude, successfully breached the ChatGPT account of an OpenAI employee and obtained documents from the company's private software code repository. The team involved is from the security firm Hacktron AI, which had previously participated in OpenAI's bug bounty program. This program provides researchers with a safe harbor, allowing them to attempt to break into corporate systems within authorized boundaries. After discovering the vulnerability, the team quickly reported it to OpenAI, which subsequently paid them a bounty of $6,500 (approximately 43,700 RMB).
The intrusion occurred against the backdrop of intensifying controversy over AI safety. On September 13, OpenAI CEO Sam Altman and others called for a pause in AI development, saying that its pace of advancement was too fast and could endanger all of humanity. On September 16, OpenAI disclosed previously unreported security incidents and announced a new security incident reporting policy. OpenAI President Greg Brockman said the company had reassigned about 25% of its production engineers from existing projects to focus on security protection and architecture hardening.
The attack began on July 23. That day, Hacktron researchers discovered a vulnerability in Discourse, the third-party service hosting OpenAI's community forum. The vulnerability, numbered CVE-2026-45788, is an unrestricted upload vulnerability in the secure upload function. The researchers used a special version of Claude Opus 4.8 provided to qualified cybersecurity practitioners, asking it to write attack code; the first attempt was unsuccessful. That evening, Anthropic released Opus 5, and the next day Claude found a way to exploit the vulnerability.
Through this vulnerability, the researchers were able to access the Discourse server and obtain account login tokens. To their surprise, these tokens were also valid on ChatGPT, including accounts belonging to OpenAI employees, and could also be used to access OpenAI's GitHub services. Through the ChatGPT interface, the researchers read files in a large software repository called "Monorepo." According to informed sources, Monorepo contains OpenAI's algorithmic secrets, equivalent to the company's "secret recipe," but does not include model weights.
After realizing they could access sensitive data, the researchers stopped the attack, but before that they had submitted a "pull request," leaving the words "Hacktron AI Team PoC" and links to members' X accounts in the repository documentation as proof of access. OpenAI confirmed that the hackers found two issues, one in Discourse and another involving OpenAI itself, both of which have now been resolved. OpenAI said it had narrowed the permission scope of community login tokens and revoked affected tokens and sessions. Discourse said it fixed the vulnerability on July 25, the day it was notified.
Hacktron AI CTO Mohan Pedhapati said the attack shows that state-sponsored advanced cyber teams do have real opportunities to spy on U.S. AI secrets. Joshua Saxe, CTO of AI security firm Abundant Security, commented that all software is riddled with security vulnerabilities, and AI gives ordinary people the ability to discover vulnerabilities as well. Cybersecurity firm ThreatDown pointed out that criminals are also acquiring these capabilities, and illegal access to similar enhanced network accounts can be purchased on cyber forums for as little as $800.
OpenAI has paid the bounty to Hacktron AI and fixed the related vulnerabilities. However, this incident highlights the complexity of protecting corporate secrets in the AI era. As AI tools lower the barrier to attacks, companies need to invest more resources in security protection. OpenAI's move to reassign a quarter of its production engineers to strengthen security may become a reference model for the industry in responding to such threats.
