Introduction
The race to build ever‑more powerful large language models (LLMs) has sparked a parallel arms race in AI‑powered cyber‑attacks. On September 18, 2026, a three‑person team from the startup Hacktron AI revealed that they could use Anthropic’s Claude to infiltrate OpenAI’s internal systems, including employee ChatGPT and Codex accounts. The breach, conducted under OpenAI’s bug‑bounty program, highlights how quickly AI tools can be repurposed as weapons.The Hack in Detail
Who Was Involved?
- Hacktron AI – independent AI security platform that tests software code.
- Anthropic’s Claude (Opus 5) – the LLM used as the primary exploitation tool.
- OpenAI – target of the attack, owner of ChatGPT, Codex, and related developer tools.
Timeline
| Phase | Action | Approx. Time |
|-------|--------|--------------|
| Discovery | Identified two critical vulnerabilities in ChatGPT and Codex account handling. | Day 1 |
| Exploitation | Leveraged Claude to chain the vulnerabilities, gaining access to multiple employee accounts. | Day 2 |
| Escalation | Took over an employee’s Codex account linked to OpenAI’s GitHub organization and opened a harmless pull request. | Day 3 |
| Disclosure | Reported findings to OpenAI; received a $6,500 bug‑bounty award. | Within 72 hours |
How Claude Was Used
1. Prompt Engineering – Hacktron crafted prompts that coaxed Claude into generating code snippets capable of bypassing authentication checks. 2. Automated Token Harvesting – Claude assisted in extracting session tokens from compromised ChatGPT accounts. 3. Service Chaining – The team linked the stolen tokens to Codex, which had permissions to OpenAI’s internal GitHub repositories, Slack, Outlook, and the Discourse forum.What Was Compromised?
- GitHub Repositories – Access to OpenAI’s source code and internal projects.
- Discourse Forum – Ability to read and modify community discussions.
- Slack & Outlook – Potential exposure of internal communications.
- Employee ChatGPT & Codex Accounts – Broad surface for further lateral movement.
Reactions from the Community
- Wall Street Journal emphasized the “strange new state of AI security.”
- Axios and The Washington Post cited executives and Pentagon officials warning that AI‑driven attacks could threaten critical infrastructure.
- Semafor noted that the breach illustrates “insufficient technical guardrails” rather than a looming superintelligence.
- OpenAI and Anthropic did not immediately comment, but OpenAI patched the Discourse flaw on July 27.
Implications for AI Security
1. AI as a Dual‑Use Tool – The same model that powers helpful assistants can be weaponized with minimal effort.
2. Speed of Exploitation – Less than 72 hours from discovery to repository access shatters the myth that sophisticated hacks require months of manual work.
3. Cross‑Model Threats – A model from one lab (Claude) can be turned against a competitor (OpenAI), raising concerns about collaborative safeguards.
4. Bug‑Bounty Programs – While valuable, they must evolve to include AI‑assisted testing scenarios.
Recommendations for Organizations
- Implement AI‑Specific Threat Modeling – Include LLM‑driven prompt injection and token‑theft vectors.
- Zero‑Trust Access Controls – Enforce MFA and least‑privilege for AI‑linked accounts.
- Continuous Monitoring of Model Outputs – Detect anomalous generation that could indicate misuse.
- Collaborative Defense Frameworks – Share vulnerability data across AI labs under controlled, legal agreements.
- Regular Audits of Third‑Party Models – Verify that external LLMs used internally meet security standards.
Conclusion
The Claude‑to‑ChatGPT breach is a watershed moment, proving that AI‑powered hacking is no longer speculative. As LLMs become more capable, organizations must treat them as both assets and potential attack surfaces. Strengthening technical guardrails, fostering cross‑industry collaboration, and rethinking security policies are essential steps to prevent the next AI‑driven breach.
- --
