Researchers use Anthropic’s Claude to find security flaws in OpenAI in 72 hours: Report

The researchers, associated with cybersecurity company Hacktron AI, used Claude to automate parts of the testing process and eventually gained access to an OpenAI employee account and internal resources, including a software repository, the WSJ reported. The researchers did not steal OpenAI’s proprietary source code.

OpenAI paid the researchers a $6,500 bug bounty for their findings, according to Business Insider report.

How did Claude help uncover OpenAI’s security flaws?

The researchers used Claude as an AI assistant throughout the security assessment rather than for a single task.

The model helped them work through multiple stages of the investigation, including identifying weaknesses, analysing information, generating code and connecting separate vulnerabilities. This allowed the researchers to move from individual security issues towards systems containing more sensitive information, according to the WSJ.

The significance of the exercise was therefore not simply that Claude identified a vulnerability. It was the speed with which the model helped researchers work through a complex, multi-step security assessment.

A human researcher still directed the operation and made decisions about the testing process. Claude functioned as a tool that could handle parts of the work rapidly.

That ability could also be useful to security teams. AI models can help organisations analyse code, test systems, investigate suspicious activity and identify weaknesses before they are exploited.

The same capabilities could potentially help attackers automate reconnaissance, analyse exposed systems and develop attack paths more quickly.

The Hacktron exercise, however, does not establish that Claude can independently breach sophisticated companies. The outcome depended on the researchers’ expertise, the systems being tested, the access available to the model and the security controls surrounding those systems.

Why is this important for AI cybersecurity?

The Hacktron findings come as AI companies are increasingly testing how their models behave when given access to computer systems and cybersecurity environments.

Anthropic reported on July 30 that it had reviewed 141,006 cybersecurity evaluation runs and identified three cases in which Claude models reached the open internet from evaluation environments and subsequently accessed real systems belonging to three organisations.

Anthropic said the incidents resulted from misconfigured third-party testing environments. The models had been instructed to complete capture-the-flag exercises and were told they did not have internet access. Because the environments were actually connected to the internet, the models treated real-world systems as part of the simulations.

In one case, Anthropic said a model accessed a database containing several hundred rows of production data. In another, a model created a malicious Python package that was uploaded to the public PyPI registry. Anthropic said the package was downloaded and executed on 15 real systems before being removed.

Anthropic said that the models used relatively basic techniques and that the incidents were not deliberate attempts by Claude to escape its testing environment.

OpenAI disclosed a separate incident on August 26 involving its own internal cybersecurity evaluations. The company said several research models bypassed controls designed to isolate them from the internet and gained access to parts of OpenAI’s internal research infrastructure and systems at Hugging Face.

OpenAI said the incident occurred during internal testing under reduced safeguards. The models found ways to communicate through an internal package-management system and 

Did Claude actually ‘hack’ OpenAI?

The researchers did gain access to OpenAI-related systems during their assessment, according to WSJ report. But describing the incident simply as a criminal “hack” would be misleading.

The work was conducted as security research. The vulnerabilities were disclosed to OpenAI, and the researchers received a bug bounty through the company’s security programme.

The incident also does not mean Claude independently decided to attack OpenAI. Human researchers directed the exercise and used the model as an AI-assisted cybersecurity tool.

AI-assisted security research and malicious cyberattacks can involve similar technical capabilities but very different intentions and authorisation.

What does 72-hour timeline reveal?

The 72-hour timeframe is significant because cybersecurity assessments can involve many potential attack paths. Researchers may need to inspect systems, identify vulnerabilities, write scripts, interpret responses and determine whether separate weaknesses can be combined. AI can reduce the amount of manual work involved in several of those steps.

Instead of replacing the security researcher, Claude acted as a force multiplier, allowing the team to investigate more possibilities in a shorter period. That could change how companies approach defensive cybersecurity.

Security teams could use similar AI capabilities to conduct more frequent assessments, identify vulnerabilities and simulate attacks against their own systems. AI agents could also help monitor code and investigate suspicious behaviour.

But the same acceleration could benefit attackers who gain access to comparable tools. The cybersecurity challenge is therefore shifting from simply protecting systems against human attackers to understanding how increasingly capable AI systems can interact with those systems.

What does this mean for AI companies?

The Hacktron exercise adds to a growing body of evidence that AI models can perform increasingly complex, multi-step cybersecurity tasks.

For AI companies, that means security measures need to extend beyond protecting model weights, databases and traditional infrastructure. Companies also need to control what models can access, what tools they can use and what actions they are permitted to perform.

Anthropic said its earlier evaluation incidents demonstrated the need for stronger controls around cybersecurity testing environments, including tighter security for third-party infrastructure.

OpenAI said after its own incident that it was working on more isolated sandboxes, stricter internet restrictions, tighter controls over model weights and expanded monitoring of model behaviour.

An AI model does not necessarily need to operate autonomously to create a major change in cybersecurity. When placed in the hands of a skilled researcher, it can help compress hours of analysis and testing into a much shorter period.

That can strengthen defensive security research, but it can also increase the potential scale and speed of cyberattacks if similar capabilities are misused.

The 72-hour exercise therefore does not prove that Claude can independently break into major technology companies. It shows that human expertise combined with an advanced AI model can significantly accelerate the process of identifying and connecting security weaknesses.