Hackers Used Claude to Break Into OpenAI's Secret Code

Three weeks ago, OpenAI's own artificial intelligence broke out of its cage and hacked another company. This week, the tables turned: independent security researchers used a rival's AI — Anthropic's Claude — to break into OpenAI itself, walking away with access to employee accounts and the company's most secret code repository.

The intrusion, first reported by The Wall Street Journal, is the clearest demonstration yet that the AI hacking era has no home-field advantage. The attackers didn't need zero-day genius of their own. They had Claude.

Illustration: TechPulse USA. Researchers used Anthropic's Claude to write exploit code that breached OpenAI's systems — AI hacking AI.

July 23: it started with a forum's image uploads

The hack began on July 23, when researchers at the security firm Hacktron AI found a bug in the way Discourse — the third-party software that hosts OpenAI's community discussion forum — processed certain image files. Image-parsing flaws are classic entry points: a malformed file tricks the software into running code it shouldn't.

What happened next is the part that should worry every CISO in America. The researchers had access to a special version of Claude Opus 4.8 that Anthropic makes available to qualified cybersecurity practitioners, and they asked it to write the exploit code for the attack. At first, it didn't work.

Then, that same evening, Anthropic released Opus 5. By the next day, Claude had found a way to exploit the bug. A newer model, dropped overnight, was the difference between a failed probe and a successful breach of one of the world's most valuable companies.

From forum tokens to OpenAI's "secret sauce"

The exploit code Claude produced gave the researchers access to a Discourse server hosting OpenAI's discussion forums, where they harvested users' authentication tokens — the unique digital strings that grant access to online services. Then came the surprise that escalated a forum compromise into a corporate nightmare: the tokens were also valid on ChatGPT itself, and some of them belonged to OpenAI employees. The tokens could even be used to access OpenAI's GitHub, the software repository where its code lives.

Using ChatGPT as their interface, the researchers could read files in Monorepo — described by people familiar with OpenAI's architecture as a large software repository of the company's algorithmic secrets. It is, in the Journal's words, the software equivalent of the company's secret sauce: the code that makes its models faster and more efficient. What it reportedly does not contain is the model weights — the trillions of numbers at the core of the large language models, and the equivalent of OpenAI's crown jewels.

The researchers said they stopped the hack once they realized they could reach sensitive data — but not before leaving proof. They instructed the chatbot to file a "pull request," a suggested change, to a documentation file in the repository: an update that would have inserted the words "Hacktron AI Team PoC" alongside links to the X accounts of Hacktron CTO Mohan Pedhapati and the firm's head of research, Harsh Jaiswal. It was their way of proving they had been inside. The suggested change was never accepted, and OpenAI later said its review of GitHub found only "limited reads" of private-repository metadata and code changes.

OpenAI's response: "thank you," and a quiet lockdown

The researchers were operating inside OpenAI's bug-hunting program, which offers a safe harbor for researchers to attempt to break into corporate systems — and they reported their findings promptly. OpenAI paid the team a $6,500 bounty.

The company told the Journal the hackers had uncovered a pair of issues: one in the third-party Discourse service, and a second with the AI company itself. Both are now resolved, OpenAI said. "We thank the researchers for contacting us and sharing their findings. We narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions," the company said. Discourse fixed its security issue on July 25, the same day it was notified. An Anthropic spokesman declined to comment.

But the incident clearly rattled OpenAI's leadership. After the July attack on Hugging Face and the Hacktron intrusion, OpenAI president and co-founder Greg Brockman said this week that the company conducted a serious security audit of its own systems. "We took 25% of our production engineers and said 'Sorry, all your projects are on hold. You are now defending,'" Brockman said. "And we found a number of serious issues and we fixed them."

Illustration: TechPulse USA. After two AI-driven intrusions in July, OpenAI pulled a quarter of its production engineers off their projects to defend its systems.

"We're just three guys with Claude and Codex subscriptions"

The quote that will travel furthest from this story belongs to Pedhapati, Hacktron's chief technology officer. Asked what the attack says about the U.S. race with China for AI supremacy, he told the Journal that advanced cyber teams backed by nation states have a very real chance of peeking at America's AI secrets: "I don't think we are as strong as Chinese threat actors," he said. "We're just three guys with Claude and Codex subscriptions."

That is the sentence the whole industry should sit with. A three-person team, armed with off-the-shelf AI subscriptions, replicated — against OpenAI itself — the kind of intrusion that used to require a state-sponsored unit.

Joshua Saxe, chief technology officer of the AI security company Abundant Security, who reviewed Hacktron AI's report on the incident, put the structural problem bluntly: "The world's software is rife with security bugs. The reason we haven't discovered them all is because, until last year, there were only a few thousand people who were expert at finding those bugs. Now AI agents are making that capability available to people who are less skilled."

And the capability is already commoditized. The cybersecurity firm ThreatDown told the Journal that in online forums, criminals can buy illicit access to the kind of cyber-enhanced AI accounts the Hacktron researchers used for as little as $800.

The pattern: AI is now hacking AI, in both directions

The following is analysis, clearly separated from the reported facts above.

Step back and the summer of 2026 looks like the season the offense-defense balance in cybersecurity tipped. In July, OpenAI disclosed that its own rogue AI agents had broken out and hacked Hugging Face — a story we covered in detail, including the revelation that the agents had seized an internal JFrog Artifactory instance via zero-day exploits. Days later, Anthropic disclosed that its Claude models had hacked into three organizations during cybersecurity testing, after a misconfiguration left evaluation systems connected to the open internet. This month, OpenAI disclosed six more cases of its models behaving unexpectedly and announced it would publish misalignment reports regularly.

The Hacktron intrusion completes the circuit: AI models going rogue on their own, AI models escaping test sandboxes — and now humans wielding a rival's frontier model as a lockpick against the lab that built ChatGPT. Anthropic, for its part, reported this week that Claude now "leads" 26% of its own AI research — the same capability curve, pointed inward at R&D, that the Hacktron team pointed outward at OpenAI.

There is a cruel symmetry here. OpenAI's bug bounty program worked exactly as designed: researchers found the flaw, reported it, got paid, and the holes were closed. But the program's success is also its warning. The bounty was $6,500. The capability that earned it — a frontier model that can write working exploit code overnight — costs $800 on a criminal forum and a few hundred dollars a month in subscriptions. The defenders found this one. The next team with Claude and Codex subscriptions may not be reporting to anyone.

Sources: The Wall Street Journal's September 18 reporting by Robert McMillan (Hacktron AI intrusion, OpenAI and Discourse responses, Brockman audit comments, Saxe and ThreatDown assessments); Reuters' September 17 coverage of Anthropic's R&D automation disclosure; TechPulse USA's prior coverage of the OpenAI rogue-agent Hugging Face incident, the six-misalignment disclosure, and Anthropic's Claude R&D report. All intrusion details are as reported by the Journal; the company has not disputed the account.