AI Risk Wire

Cases › security breach › LR-2026-0735

Hacktron researchers use Claude to access OpenAI employee ChatGPT accounts

Preliminary Why: 1 report: Newscord · subject to change · 1 independent report

Status: action reported, no fix

Severity moderate
Reported 18 Sep 2026
Developer and model Anthropic · Claude

No source states: loss or records, agent tool, could do, deployer, industry.

Severity moderate: Test: data and systems of others touched (OpenAI employee accounts and code). Scope is not stated as bounded or unbounded; the only scope sentence is a researcher's theoretical claim, so the moderate tier is a judgement.

Hacktron AI used Anthropic's Claude to access OpenAI employee ChatGPT accounts and internal code, reached via an OpenAI staff discussion forum hosted on the Discourse platform. The access allowed reading private software and proposing changes to OpenAI's code repositories. The researchers said they showed permission levels by making a harmless pull request rather than downloading code. The intrusion reportedly began on July 23 with a flaw in how Discourse processed certain image files, and OpenAI said it had found two problems, one in Discourse and one in OpenAI itself. OpenAI said it had resolved both, constrained login token permissions for Community, and revoked affected tokens and sessions. The researchers were paid $6,500 under OpenAI's bug bounty program.

What happened

1 · What it was doingHacktron researchers used Anthropic's Claude to access OpenAI employee ChatGPT accounts and internal code.
2 · What went wrongThe intrusion reportedly began with a flaw in how Discourse processed certain image files, and OpenAI said it had found two problems.
3 · What it reached or didThe researchers reached ChatGPT accounts through an OpenAI staff forum and made a harmless pull request to OpenAI's GitHub repository.

What was done

OpenAI said it resolved both issues, constrained login token permissions for Community, and revoked affected tokens and sessions.

Risks

AI used to run a cyber attack
Primary96 incidents
Rising: 24 vs 4.0 a week
AI system attacked or breached
Also23 incidents

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Model

Safety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring

Infrastructure / target

Known flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters

Similar incidents

Chinese grey market resells Claude API access using stolen credentials2026-05-09
Anthropic Claude models gained unauthorized access to real third-party systems during evaluations2026-10-22
Claude used to build Malaysian election influence platform with ~1,000 fake X accounts and fabricated news outlet2026-10-01
Russia-linked cyberespionage group used Claude to reverse-engineer military drone firmware2026-09-15

All cases of this kind ›

Evidence

No source states: how it was caught, when it happened, when it was found, how many records were exposed, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 4 items from the primary sources

What happened, in order

  1. July 23 The intrusion began when Hacktron researchers found a flaw in how Discourse processed certain image files.
  2. July 28 Discourse published advisory GHSA-vhm9-85gw-x335.

Not dated in the sources:

  • OpenAI confirmed a fix, roughly 14 hours later than an earlier point.
  • OpenAI later awarded $6,500 for the OpenAI-side finding.
Show every field, with its source and grade

The AI system

Model
Claude
C one secondary source states it
Developer
Anthropic
C one secondary source states it

What happened

Earliest source we hold
2026-09-18
D inferred by us from the described behaviour, reason shown
Cause in detail
a flaw in how Discourse processed certain image files
C one secondary source states it
What went wrong
security breach
C one secondary source states it

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Who was affected
OpenAI employee ChatGPT accounts and internal code
C one secondary source states it
Why this severity
Test: data and systems of others touched (OpenAI employee accounts and code). Scope is not stated as bounded or unbounded; the only scope sentence is a researcher's theoretical claim, so the moderate tier is a judgement.
D inferred by us from the described behaviour, reason shown

Notes on gaps

It is not a primary report from OpenAI, Hacktron or Anthropic, and the claim that 19 outlets reported it the same way is unverified. Discourse's 22:49:45 UTC fix time is relative to an unnamed earlier point, so no full date is given. The OpenAI security audit and staff reassignment reported by Babnet are uncorroborated and not recorded as remediations.

LR-2026-0735 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON