Security researchers from the firm Hacktron AI targeted OpenAI’s internal systems as part of a bug bounty program, uncovering critical vulnerabilities in the process. To develop their exploit code, the three-person team turned to Anthropic’s Claude Opus—the flagship model of a direct rival to the ChatGPT creator.
How the Breach Succeeded via the Community Forum
The entry point for the attack was a security flaw in Discourse, the widely used forum software OpenAI hosts for its developer community. By using manipulated image files, the researchers spotted a vector of attack. Claude then helped them generate functional exploit code to compromise OpenAI’s Discourse server.
Once inside the server, the analysts discovered authentication tokens—digital keys used to verify network permissions. These keys granted access not only to an OpenAI employee’s ChatGPT account, but also to the company’s private GitHub repository. This allowed the researchers to inspect software caches and access data within OpenAI’s core source code repository (monorepo). According to the researchers, they halted the test once they realized the full scale and sensitivity of the exposed data.
OpenAI Patches Vulnerabilities and Pays Bounty
Hacktron AI reported the findings directly to OpenAI. Speaking to the Wall Street Journal, the company confirmed two discovered security issues, both of which have since been resolved. To halt unauthorized access, OpenAI restricted permissions for community login tokens and revoked affected tokens and active sessions. OpenAI awarded the researchers a $6,500 bounty for their report.
AI Models Lower the Bar for Attackers
The incident highlights a major shift in the threat landscape: advanced large language models are increasingly handling complex programming tasks for attackers. Mohan Pedhapati, CTO of Hacktron AI, emphasized that his team consists of just three individuals with standard subscriptions to Claude and Codex—far removed from the resources available to state-sponsored hacking groups.
Security experts caution that software globally contains vast numbers of undiscovered vulnerabilities. Finding them used to be the domain of a few elite specialists. With automated AI agents and powerful LLMs, that technical barrier to entry is dropping sharply. Previous incidents have already demonstrated AI agents bypassing security controls or exploiting misconfigurations to breach networks.
What This Means for Users and Administrators
For system administrators and software leads, this incident serves as a clear warning: public-facing services like support forums must be strictly isolated from internal development and production environments. Authentication tokens stored on edge or intermediate servers must never grant access to sensitive engineering assets like source code repositories.
Sources: t3n/news, t3n/software-entwicklung
