Three cybersecurity researchers in India were able to hack OpenAI using a rival AI model from Anthropic, revealing that advanced artificial intelligence can put the companies themselves, and their users, at risk of attack.
Mohan Pedhapati, one of the three researchers from a company called Hacktron who broke into OpenAI, said that more advanced AI models allow veteran hackers like him to do their work much more easily — and raise the risks of criminals doing the same. He described each new model as “a force multiplier” that empowers hacking.
“As the models progress, they become very capable in cyber,” he said.
In a report published last week, Hacktron detailed how, in late July, they used Claude models to infiltrate users of OpenAI’s community forum. The forum is a space where users of ChatGPT and Codex, OpenAI’s coding agent, might go to ask questions about the products. Users can sign in with their OpenAI accounts.
The Hacktron researchers used Claude Opus 4.8 to find flaws in the code of a third-party service called Discourse, used for the OpenAI community forum. They tried to use Opus 4.8 to exploit the flaw, but were unsuccessful. However, that very same night, a more advanced model, Claude Opus 5, was released.
The next day, the Hacktron team could access the ChatGPT and Codex accounts of a subset of OpenAI users who were on the community forum. This was yet another reminder of the lightning speed of AI development — of how, in this case, literally overnight, capabilities can change in the AI world.
Once Hacktron had access to users’ ChatGPT and Codex accounts, the researchers said they also could have gained access to apps connected to these accounts, including email apps and Slack. They had the ability to see whatever conversations the users were having on ChatGPT. Some of those users included OpenAI employees, whose accounts were connected to other apps as well, like internal OpenAI email.
“Everything that you’re talking to ChatGPT [about] — we could leak it. We could get access to it,” Pedhapati said. “I can see whatever you’re talking to ChatGPT with. Like all the personal stuff or the private stuff.”
The Wall Street Journal first reported on Hacktron’s OpenAI report.
It’s common for big tech companies to offer “bug bounties.” These are payments made to outside security researchers — sometimes called “ethical hackers” — who discover security vulnerabilities in the larger company’s digital infrastructure. Find a flaw, document it and share it with the company, and you may get paid a bounty — thousands of dollars or, rarely, millions.
OpenAI has offered several bug bounties. This is what Hacktron was doing when it broke in. Their goal was to help OpenAI by pointing out gaps in their security, and then gain access to one of their more capable cyber models that have fewer guardrails.
“We are the good guys,” said Pedhapati.
Pedhapati said that it would have taken him two to three months to perform a hack like this without the help of Claude.
“That’s me doing it alone without any help,” he said. “But if you add these models, that changes the equation.” The entire hack took the Hacktron team less than three days.
Newer models from both Anthropic and OpenAI have been released since then, and Pedhapati estimates it could now take him less than a day to perform such a hack. Pedhapati and the small team at Hacktron have also hacked Apple, Google, Facebook, Discord and Microsoft Teams in the past, he said.
Pedhapati is worried that companies like OpenAI are not as secure as they need to be, considering how powerful their AI models are.
“You need to assume everyone can hack you, and then build your things based on that. On that trend, I think many of the labs are not doing it well,” he said. “OpenAI, Anthropic, they’re just, I think, speed running.”
The Hacktron team didn’t have to exploit OpenAI directly to gain access to its users’ accounts. They only had to find a flaw in one of the many third-party services used by OpenAI.
“Every company has a dependency that goes deep and deep. You don’t need to find a vulnerability in OpenAI source code itself, you can go one step down,” Pedhapati said. “It spirals up and comes back to the company that uses it.”
In a statement to CBS News, OpenAI thanked the researchers for sharing their findings.
“We narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions,” an OpenAI spokesperson said.
AI companies and their employees, in the wake of the Hugging Face hack, are speaking more openly of concerns about society-wide risks of powerful AI.
“Like many technologies before it, AI brings risks, and because it is such a powerful technology, these risks are serious,” Anthropic CEO Dario Amodei recently told CBS News.
One of those risks is that the models themselves could be stolen, particularly the “weights” that help make these models so capable. For years, researchers have worried that even if companies developing powerful internal models don’t release them to the public, foreign adversaries or criminals could still steal them. If a small company like Hacktron can hack into OpenAI in a few days, an enemy state could likely do it as well, possibly even faster.
“I think unquestionably that the labs’ technology is national security relevant. We’ve seen that from the administration here and from governments across the world,” said Nicholas Leiserson, a cybersecurity policy expert at the Institute for Security and Technology.
Despite some recent statements from AI leaders acknowledging a need to slow down development, pushing the frontier as fast as possible has, for years, been the priority for labs like OpenAI, Leiserson said.
“Is that a comfortable place for us to land? Is that somewhere that we as a society feel is the appropriate risk level? Because right now it is the labs who are making that determination, and we’ve seen where they’ve landed.”
