Researchers breached OpenAI using an Anthropic security tool

In short: Paid security researchers broke into an OpenAI employee’s ChatGPT account while testing security, using a tool from rival Anthropic.

What happened

Three researchers from Hacktron AI, a small cyber security company, found a way to access an OpenAI employee’s ChatGPT account, according to the Financial Times. That access let them read private software information and suggest changes.

The researchers were working under OpenAI’s “bug bounty” program. That is a common setup where companies pay ethical hackers to find weaknesses before criminals do. OpenAI paid the group $6,500.

The group used an Anthropic tool that is designed for security professionals. They exploited a problem in how OpenAI’s community forum was set up. The forum is run on Discourse, a third-party service (like renting a ready-made website instead of building one from scratch). The flaw helped them get access to internal sign-ins and then to the employee’s ChatGPT account, which had access to internal code through GitHub.

OpenAI said it thanked the researchers for reporting the issue and that it fixed the problems. Anthropic declined to comment.

Why it matters

This incident is another reminder that AI companies also face basic security risks, like account access and login systems. If the wrong people get into employee accounts, they might reach private code or internal tools, similar to finding a spare key that opens more doors than it should. The report also lands as US officials debate how to review and release powerful AI systems, partly because those systems can help attackers work faster.

Source: Financial Times