OpenAI hacked via Anthropic's AI model Claude

OpenAI was hacked earlier this year using Claude, the AI model from competitor Anthropic. Researchers from Hacktron AI managed to gain access to the ChatGPT accounts of several OpenAI employees through a vulnerability in a third-party forum, and ultimately to the company’s internal GitHub codebase. OpenAI has since fixed the vulnerabilities and rewarded the researchers through its bug bounty programme.

In brief:

• Hacktron AI used Anthropic’s Claude to exploit vulnerabilities at OpenAI
• The attack gave access to employee accounts and the internal GitHub codebase
• OpenAI fixed the issues and paid the researchers $6.500

Claude used to attack OpenAI

The researchers from Hacktron AI used Claude, Anthropic’s large language model, to find and exploit a vulnerability in a forum of a third-party provider used by OpenAI. Through that forum, they managed to gain access to the ChatGPT accounts of several OpenAI employees.

From those accounts, they found a route into OpenAI’s internal GitHub codebase, where sensitive source code and project information are stored. The breach took place in July, but the findings are only now being made public, according to the Financial Times.

OpenAI pays $6.500 to researchers

After the vulnerabilities were reported, OpenAI fixed them. The company paid the researchers $6.500 through its bug bounty programme. Such programmes are intended to encourage external security researchers to report vulnerabilities responsibly instead of exploiting them or making them public.

The case shows how AI models are not only used for productive purposes, but also as a tool in security research and in identifying weaknesses in other companies’ systems. The fact that OpenAI, one of the best-known AI companies in the world, was the target of an attack carried out partly with a competitor’s technology makes the disclosure remarkable.