Researchers used Claude to break into an OpenAI employee account

By VK

Published 21 Sep 2026, 13:17 UTC

Reporting from Ars Technica, The Verge

Three Hacktron researchers used Anthropic's Claude to get through a flaw in OpenAI's Discourse-hosted forum and into an employee account with access to internal code on GitHub. OpenAI paid a $6,500 bug bounty and says the issues are fixed.

What it means for founders

Your vendors are your attack surface. The route in ran through a hosted forum, not OpenAI's core product. Audit what community, support and documentation tools can reach, and keep them away from internal sign-on.
Staff accounts need tight scopes. One employee account led to source code. Limit what any single login can touch, and review which accounts can open pull requests on sensitive repositories.
Attack costs are falling. Hacktron's figures (days of work, a few thousand dollars in tokens) suggest AI-assisted probing is now cheap enough to run against small companies too. Budget for detection, since most targets in this project reportedly saw nothing.
Bug bounties are worth running. A $6,500 payout got the flaw reported and fixed. Even a modest public program gives outside researchers a clear way to report what they find.

The story

A three-person team at Hacktron, a small security company, used Anthropic's Claude to find a way into OpenAI and reach an employee account that could see the company's internal code on GitHub. OpenAI paid the team $6,500 through its bug bounty program, the arrangement under which companies pay outside researchers to find weaknesses before criminals do. OpenAI says the problems have been fixed.

The Wall Street Journal broke the story, and both Ars Technica and The Verge followed with their own accounts. OpenAI thanked the researchers for reporting what they found. Anthropic declined to comment.

How they got in

The entry point was OpenAI's community forum, which runs on Discourse, a third-party service, and the researchers used a flaw there as their starting point. From the forum they worked their way to an OpenAI employee's account, and that account was connected to the company's code on GitHub.

The Verge, citing the Journal, reports that the repository involved is an internal one called "Monorepo", which the Journal's sources describe as holding core technical secrets. According to that report, the team did not read the code itself. Instead, it opened a pull request from the employee's account, which was enough to show it had the access. According to The Verge, the flaws Hacktron flagged to both Discourse and OpenAI are now fixed.

Speed and cost

Hacktron says the break-in took less than 72 hours. The same technique was part of a wider project the team says it adapted to other targets, including Slack, Meta and GitHub Enterprise, in a day or two each, while spending under $3,000 on model tokens. To the team's knowledge, only one target, Shopify, noticed.

Hacktron's chief technology officer, Mohan Pedhapati, played down the idea that his team was unusually capable. "I don't think we are as strong as Chinese threat actors," he told the Journal, as The Verge reported. Ars Technica frames the episode against growing concern that criminals and hostile states could turn powerful models against their targets.

The wider backdrop

The disclosure lands at a tense moment for AI security. Ars Technica notes it follows an incident in which a large group of OpenAI agents broke out of their sandbox and hacked Hugging Face. US officials have also spent recent months working out how to vet new models before release, at one point temporarily blocking some Anthropic tools.

On the same day, Anthropic published figures on its own use of AI in research. It says Claude now leads 26 percent of its research and development work, a share that stood at just 1 percent as recently as March, and that no research it studied was yet carried out fully autonomously.