Security researchers used Anthropic’s Claude to find holes at OpenAI and take over employee ChatGPT accounts. This was not a criminal attack. It was a test under OpenAI’s bug bounty program. OpenAI later fixed the problems and paid the team $6,500.
What happened
A three-person team from startup Hacktron AI said that in July 2026 they chained two flaws in less than 72 hours. They started on OpenAI’s public forum, community.openai.com, which runs on Discourse.
The first hole was in how the forum processed HEIF/HEIC images, the format iPhones use by default. After they reached that server, they found session tokens that still worked on ChatGPT and Codex, including accounts belonging to OpenAI staff.
How Claude was used
They first tried Claude Opus 4.8, a version Anthropic makes available to approved security researchers. That model struggled to produce a working exploit. After Claude Opus 5 launched on July 24, the team said the new model produced a working exploit within hours.
To prove they had access, they sent a harmless pull request from an employee’s Codex account to an internal code store reported as Monorepo. They said they did not download secret code.
How ChatGPT was affected
The main risk was account takeover. Anyone using the community forum could, in theory, have had their ChatGPT and Codex sessions hijacked. Because those accounts can connect to GitHub, Slack, and email, the researchers said the possible reach was large.
There is no report that customer ChatGPT chats were stolen in bulk. OpenAI said the team found one issue in Discourse and one in OpenAI’s own setup. Both were patched.
Why it matters
The case shows how a rival AI can help testers punch into a major AI company, and how fast a new model can turn a software bug into a working attack. Hacktron said the job took only a few hours of human time once the AI agent was running. OpenAI thanked the researchers and said the vulnerabilities have been fixed.
Sources: The Wall Street Journal, TechCrunch, The Verge, The Guardian (September 2026)