AI vs. AI Red Teaming: Researchers Use Anthropic's Claude to Breach OpenAI's ChatGPT in Under 72 Hours

In what represents one of the most consequential demonstrations of artificial intelligence deployed in offensive cyber operations to date, a team of independent cybersecurity researchers has revealed how they used Anthropic's Claude to breach systems belonging to chief competitor OpenAI. Operating under cybersecurity startup Hacktron, the research trio managed to compromise OpenAI employee accounts and establish theoretical access to private software repositories in less than 72 hours.

The investigation, spearheaded by security researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini, highlights a dramatic shift in how software vulnerabilities are identified and weaponized. Rather than relying solely on conventional penetration testing tools, the team leveraged Claude as an interactive reasoning engine to accelerate reconnaissance, analyze unfamiliar authentication flows, and chain disparate system weaknesses into a high-impact exploit.

The breach originated not within OpenAI's core foundation model weights, but within its surrounding digital perimeter—specifically, an OpenAI staff and user discussion portal powered by the open-source community platform Discourse. By auditing how authentication tokens and single sign-on protocols interacted between Discourse and OpenAI's broader application ecosystem, the researchers discovered a critical logic flaw.

Using Claude to rapidly model attack trees and simulate responses from the target servers, the Hacktron team synthesized an exploit mechanism capable of intercepting employee sessions. Any OpenAI staff member or user who interacted with the compromised forum environment became susceptible to full account takeover across associated services, including ChatGPT and developer tool Codex.

Because modern AI workflows frequently rely on interconnected developer tooling, the blast radius of the compromised accounts extended far beyond conversational chat histories. The researchers noted that once an employee's ChatGPT and Codex sessions were compromised, the secondary access vectors were immense.

In an enterprise environment where developers link AI programming assistants to company accounts, the attack theoretically granted the ability to inspect sensitive internal communications, read confidential Slack channels, and interface with GitHub environments. To conclusively prove the severity of the vulnerability without causing disruption, the researchers initiated a benign pull request—a proposed modification to source code—targeting a private OpenAI GitHub repository, confirming write-level visibility.

The entire operation was conducted under OpenAI's formal bug-bounty program. Following strict responsible disclosure principles, the researchers did not view sensitive customer data, alter production codebases, or push unauthorized software changes into the wild. OpenAI promptly validated the findings, patched the underlying authentication vulnerabilities in its forum implementation, and rewarded the researchers for their contribution.

The episode nevertheless underscores the growing friction between accelerated product deployments and perimeter defense. While AI labs invest billions in red-teaming their models against biological hazards, cyberweapon generation, and jailbreaking, their enterprise IT surfaces and third-party SaaS integrations remain vulnerable to standard software misconfigurations—now discovered at machine speed.

The broader implication of the Hacktron disclosure lies in the democratization of high-speed vulnerability hunting. Security analysts have long warned that large language models with advanced reasoning and code analysis capabilities would inevitably lower the barrier for sophisticated cyber maneuvers. The fact that Claude was actively utilized to unravel the perimeter of OpenAI crystallizes this reality.

As autonomous agentic workflows become standard across cybersecurity operations, defensive teams must prepare for an environment where attackers iterate exploit chains in hours rather than weeks. The frontier of AI security is no longer confined to guardrailing conversational prompts; it now demands rigorous zero-trust containment for the entire computational and organizational ecosystem in which these models reside.

• CBS News - AI security experts say they used Claude to hack ChatGPT
• The Guardian - OpenAI 'ethically hacked' with help of Anthropic's Claude chatbot
• Tom's Hardware - Hackers breach OpenAI using Claude tools, gaining access to employee accounts and the company's internal codebase
• PCMag - Security Researchers Hacked OpenAI Using Anthropic's Claude