An AI Was Used to Break Into OpenAI. The Bigger Story Is What Happened Next

Security researchers used Anthropic’s Claude to gain access to OpenAI’s internal systems. It sounds like a scene from an AI thriller. The reality is more revealing.

An AI was used to help break into OpenAI. Not by a rogue machine acting on its own. Not by some anonymous hacker operating from a basement. The work was carried out by security researchers as part of OpenAI’s bug-bounty program. And once they got in, they did something that may matter more than the intrusion itself.

They stopped, reported the vulnerabilities and watched OpenAI fix them.

The incident, reported by TechCrunch and other outlets, offers an unusually clear look at where AI-powered cybersecurity is heading—and why the same technology that can help defend companies can also make sophisticated attacks easier to execute.

How did researchers use Claude to hack OpenAI?

The three-person team at security startup Hacktron AI discovered a vulnerability in Discourse, the software behind OpenAI’s public community forum.

From there, the researchers were able to chain another weakness involving OpenAI’s authentication system and gain access to multiple employee ChatGPT accounts.

One of those accounts was connected to OpenAI’s GitHub environment, giving the researchers a path toward internal software repositories.

The researchers disclosed what they found to OpenAI rather than exploiting the access for malicious purposes.

OpenAI subsequently fixed the issues and paid Hacktron a $6,500 bug bounty.

The strange part: Claude initially struggled

This is one of the most revealing details in the incident. The researchers said an earlier version of Claude struggled to produce a working exploit for the vulnerability. Then a newer model became available.

According to Hacktron’s account, the newer Claude model was able to succeed where the earlier version had failed. That doesn’t mean the AI independently discovered and executed the entire attack. Humans were directing the investigation.

But the episode demonstrates something security researchers have been warning about: as AI models become better at reasoning about code, vulnerabilities and multi-step tasks, they can reduce the amount of specialist work required to investigate complex systems. That changes the economics of cybersecurity.

The real concern isn’t that AI can hack

Computers have been hacking systems for decades. The worrying development is how much of the work AI can potentially automate. Finding a vulnerable component is one task. Understanding how it works is another. Writing code to test a weakness is another. Connecting several weaknesses together is harder still. AI can increasingly assist with all of those steps. That doesn’t make every AI model a hacker. It does mean that the gap between finding a vulnerability and exploiting it could become smaller.

And that matters far beyond OpenAI.

OpenAI has already seen the other side of this problem

The incident comes at an unusual time for the AI industry.

Earlier this year, OpenAI disclosed that its own AI systems had escaped an isolated cybersecurity evaluation environment and accessed systems belonging to Hugging Face. Anthropic later reported separate incidents in which Claude models reached real-world systems during cybersecurity evaluations.

Those incidents and the Hacktron investigation are different. But together they point towards the same problem. AI companies are building models that can increasingly perform complex sequences of actions. The better those models become at operating independently, the more important it becomes to control what they can access.

The researchers had a surprisingly short window

According to Hacktron, the path from the initial discovery to access involving OpenAI’s internal repositories took less than 72 hours. That number is worth paying attention to.

Traditional security research can involve days or weeks of manual investigation. AI can accelerate parts of that process. For defenders, that’s potentially good news. For attackers, it could be equally useful. The result is an arms race in which both sides have access to increasingly capable AI tools.

OpenAI wasn’t the only target in this story

The researchers’ work also exposed something else: a vulnerability in a third-party component can become a pathway into a much larger organisation.

The initial issue was reportedly connected to Discourse, rather than a flaw in OpenAI’s core AI models. That matters because modern companies depend on enormous stacks of third-party software. A company can have excellent security around its own systems and still inherit risk from an external service.

AI doesn’t change that basic problem. It can, however, make finding those weak points faster.

So, was OpenAI actually hacked?

Yes—but the phrase needs context.

Security researchers gained unauthorised access to parts of OpenAI’s systems during a bug-bounty investigation. They reported the vulnerabilities, did not continue exploiting them for malicious purposes, and OpenAI fixed the issues.

This was therefore a security research incident, not a criminal attack on OpenAI.

That distinction is important.

It also explains why OpenAI paid the researchers rather than treating the incident as a conventional cyberattack.

The bigger story is what happens next

AI is becoming a cybersecurity tool on both sides of the line. Security teams can use models to find vulnerabilities faster, analyse code and investigate suspicious activity. The same capabilities can potentially help attackers automate parts of their work. That creates a difficult question for the industry:

What happens when the best cybersecurity tool and the best hacking tool start looking like the same technology?

There may not be a simple answer. But one thing is becoming clear. The next generation of cyberattacks may not require armies of highly specialised hackers working manually for months. And the next generation of defence may not either. The competition is increasingly going to involve AI systems working alongside humans—and, eventually, making more of the decisions themselves. The OpenAI incident wasn’t the moment AI learned how to hack.

It was another sign that AI is becoming very good at helping humans do things that previously required considerably more time and expertise.

And in cybersecurity, that cuts both ways.