Researchers used Claude to hack OpenAI

Security researchers demonstrated a chain of weaknesses that used Anthropic’s Claude model to penetrate parts of OpenAI’s internal systems. The researchers exploited a misconfiguration in OpenAI’s community forum, which is hosted by the third-party discussion platform Discourse, and used that access to reach internal sign-on mechanisms and ultimately an OpenAI employee’s ChatGPT account. That ChatGPT account had access to internal code stored on GitHub.

OpenAI said it had been contacted by the researchers, thanked them for sharing their findings, and fixed the identified issues. Anthropic declined to comment on the matter. A separate group named Hacktron did not immediately respond to requests for comment. The initial public report of the disclosure was published by The Wall Street Journal.

The disclosure coincides with Anthropic’s release of internal data showing a sharp rise in how much its Claude model is used in research and development. Anthropic reported that 26 percent of R&D work was “led by” Claude, up from 1 percent in March; the company described this as meaning the model completed the majority of tasks based on human instruction and supervision. Anthropic framed the release as a way to inform the public about how close AI may be to achieving so-called recursive self-improvement, where systems train and improve themselves or new models.

Anthropic also noted that, in the research it examined, its models were not yet operating fully autonomously: on roughly 90 percent of tasks the AI “collaborates” with a human and performs substantial portions of the work. The episode and the accompanying data highlight tensions between accelerating AI-driven workflows and the security and governance challenges of increasingly capable models and complex third‑party software stacks.