Security researchers at Hacktron AI used Anthropic’s Claude during an authorised vulnerability investigation that ultimately gave them access to an OpenAI employee’s ChatGPT account and connected internal resources, according to reports published on 18 September 2026.

The incident was not a criminal intrusion. The researchers were conducting security research and responsibly disclosed the weaknesses. OpenAI subsequently tightened permissions, revoked affected tokens and sessions, and paid Hacktron a $6,500 bug bounty.

The episode is significant beyond the companies involved. It illustrates how increasingly capable AI systems can compress parts of vulnerability research and exploit development, potentially changing both defensive security work and the threat landscape.

Key takeaways

  • Hacktron AI researchers found vulnerabilities affecting OpenAI’s community forum and account access.
  • The team used Anthropic’s Claude as part of its authorised security research workflow.
  • The researchers demonstrated access to an OpenAI employee account and the ability to propose a change in an internal code repository, but said they stopped short of accessing proprietary code.
  • OpenAI fixed the reported issues, narrowed Community sign-in token permissions and revoked affected tokens and sessions.
  • Hacktron received a $6,500 bounty for responsibly reporting the findings.

What happened

According to reporting by The Wall Street Journal , Hacktron’s researchers began with a vulnerability involving Discourse, the third-party software used for OpenAI’s community forum. The weakness involved image processing and eventually allowed the researchers to obtain authentication tokens.

Some of those tokens were associated with OpenAI employees. The researchers were then able to access an employee’s ChatGPT account and demonstrate that connected permissions could reach other internal services.

The team used Claude while developing and testing the exploit chain. Reporting from The Guardian and other outlets describes the work as ethical hacking conducted under a vulnerability-disclosure framework rather than a malicious attack.

What the researchers actually accessed

The distinction between demonstrating access and stealing proprietary information is important. Hacktron said its researchers stopped after proving the weakness and did not deliberately inspect OpenAI’s internal source code.

As proof that the permissions were real, the researchers used the compromised access to propose a documentation change through a pull request in an internal repository. OpenAI’s review reportedly found limited reads of private-repository metadata and code changes.

That makes descriptions such as “OpenAI was hacked” technically understandable but potentially misleading without context. The event was an authorised security investigation, the researchers disclosed the flaws, and the affected systems were subsequently remediated.

OpenAI’s response

OpenAI confirmed that the researchers contacted the company and shared their findings. In a statement reported by Business Insider, the company said it narrowed permissions on Community sign-in tokens and revoked affected tokens and sessions.

OpenAI paid Hacktron $6,500 through its bug bounty programme. The company also operates broader security and safety bounty programmes intended to encourage researchers to report vulnerabilities and AI-related abuse risks responsibly.

OpenAI’s Safety Bug Bounty programme , launched in March 2026, explicitly extends beyond conventional software vulnerabilities to include meaningful AI abuse and safety risks.

Why Claude’s involvement matters

The most consequential part of the story is not simply that one AI company’s technology was used while testing another AI company. It is the amount of leverage advanced models can provide to a small security team.

Hacktron has separately documented experiments in which Claude assisted with difficult exploit-development work. Such systems still require skilled human supervision, suitable testing environments and repeated verification, but they can automate or accelerate tasks that previously demanded substantial specialist effort.

This has a positive side. Defensive teams, penetration testers and bug-bounty researchers can use AI to find weaknesses earlier and help vendors fix them before criminals exploit them.

The same capability creates risk when similar tools are used without authorisation. Faster vulnerability discovery can shorten the time between a software flaw becoming knowable and a working exploit appearing. Organisations therefore have less room for slow patching, excessive permissions and weak separation between externally exposed systems and sensitive internal services.

The account-token lesson may be more important than the AI rivalry

Much of the attention around the disclosure focuses on Claude being used against OpenAI. From a security perspective, the more durable lesson concerns authentication boundaries.

A vulnerability in a community-facing service became more serious because authentication tokens could provide access beyond that service. When credentials or session tokens carry broad permissions across connected systems, compromising a relatively low-risk application can become a path towards more sensitive resources.

OpenAI’s decision to narrow token permissions reflects a core security principle: credentials should receive only the access necessary for their intended purpose.

AI is changing the economics of security research

Advanced AI does not eliminate the need for experienced cybersecurity professionals. Models can produce incorrect assumptions, unreliable exploit code and false positives, and their work needs validation. But they can allow a small team to explore more hypotheses and iterate more quickly.

That changes the economics on both sides of cybersecurity. Defenders can investigate more software, while attackers may also gain access to capabilities that once required larger teams or deeper specialist expertise.

For businesses, the practical response is not to panic about AI-powered hacking. It is to strengthen fundamentals: minimise token and account privileges, isolate sensitive systems, patch internet-facing software quickly, monitor unusual authentication activity and maintain a well-run vulnerability-disclosure process.

What happens next

The vulnerabilities described by Hacktron have been reported and remediated, according to OpenAI. The larger question is how quickly security practices adapt as frontier models become more capable at software analysis and cybersecurity tasks.

Bug bounty programmes provide one mechanism for directing those capabilities towards defence. But companies will also need stronger access controls, better isolation and faster remediation because AI-assisted researchers — authorised or otherwise — can increasingly test complex systems at greater speed.

Sources