OpenAI has been pulled into a new AI security drama after researchers at startup Hacktron AI used Anthropic’s Claude to gain access to an OpenAI employee’s ChatGPT account and reach internal code through GitHub, according to reporting from the Financial Times and Wall Street Journal. The episode started July 23, 2026, when the researchers exploited an image-processing flaw in OpenAI’s community forum hosted on Discourse. OpenAI says it fixed the issues and paid the team a $6,500 bug-bounty reward. Anthropic declined to comment.
What makes the story travel fast is not a stock move — there is none, because OpenAI and Anthropic are private — but the symmetry of the attack. A security startup used one frontier model to probe another frontier model maker’s defenses, then stopped after submitting a harmless pull request to OpenAI’s private openai/openai monorepo as proof of access. VentureBeat and Anadolu Agency reported that the researchers say they did not read sensitive code. The headline tension is obvious anyway: the tools meant to speed work inside AI companies are now also helping outsiders test where those companies break.
The setup looks less like a Hollywood-style hack than a controlled red-team exercise that still exposed a real flaw. The researchers were participating in OpenAI’s authorized bug-hunting program, and the vulnerability was later confirmed in a July 28 advisory from Discourse with a CVSS score of 8.8. Discourse patched it. That matters because the community forum was the initial doorway, not the prize itself. Once inside, the researchers were able to move from a website bug to an OpenAI employee account, then to internal code access through GitHub, according to the cited reports.
The most attention-grabbing part is the model switch. According to Forbes and the Wall Street Journal, the researchers first tried Claude Opus 4.8 and it struggled. They then succeeded after Anthropic released Opus 5 on July 24. That sequence suggests the work was less about a single exploit than about using model capability to push through a messy chain of tasks. In practical terms, the AI is doing what expert humans would normally do: interpret prompts, reason through steps, and keep the attack moving when one route stalls.
Hacktron’s own framing is built around that idea. In its report, the researchers wrote: “Software has long benefited from a kind of security through complexity…AI is removing that protection by turning more of this scarce expertise into compute.” That is a thesis, not a measurement, but it explains why the episode has landed so hard inside the AI industry. The risk is no longer just that code can be broken by elite specialists. It is that model access lowers the cost of trying.
The team also made its point with a controlled demonstration rather than a destructive one. VentureBeat and Anadolu Agency reported that the researchers submitted a harmless pull request to OpenAI’s private openai/openai monorepo as proof of access, then stopped. That restraint does not erase the seriousness of the finding. It does, however, keep the incident inside the boundary of an authorized test rather than a data theft narrative. OpenAI also publicly thanked the researchers. “We thank the researchers for contacting us and sharing their findings,” the company said, according to the Financial Times and Wall Street Journal.
The industry has spent years warning that prompt injection, account compromise and web-app bugs can become more dangerous when paired with powerful models. This case puts those warnings in the same story. The researchers were not reported to have bypassed OpenAI’s systems with one magical exploit. They used a chain: an image-processing flaw, account access, GitHub movement and model-assisted execution. That is exactly the kind of compound risk that security teams worry about, because each step may look manageable in isolation.
It also highlights a growing problem for AI companies that publish interfaces, developer tools and public forums while trying to protect internal systems. The more connected the product surface is to developer infrastructure, the more a weakness in one place can cascade into another. Here, the community forum was the entry point, but the value was in the access it enabled. For companies racing to ship new features, that means security can no longer sit at the edge of the product roadmap. It has to be built into the same AI workflow that is accelerating the product itself.
The public dispute over terminology is part of the story too. The FT framed the event as a breach. Hacktron and the WSJ description make it sound more like an authorized bug-bounty test that ended before any sensitive reading. Both can be true in different senses: the researchers obtained unauthorized access in the course of a sanctioned program, but the operation was also bounded and reported. For readers, the important detail is not the label. It is that an OpenAI employee account and internal code were reachable through a flaw tied to a public-facing forum.
OpenAI has now done what companies usually do after a red-team-style scare: patch, audit and tighten. The company said it fixed the issues. Separately, the Wall Street Journal and Infobae reported that after this episode and an earlier Hugging Face incident, OpenAI conducted a security audit, with President Greg Brockman saying 25% of production engineers were reassigned to defense and that “several serious problems” were found and fixed. That suggests the company sees the problem as structural, not isolated.
The broader takeaway is that AI security is becoming a competition between capabilities. The same systems that can draft code, summarize documents and assist researchers can also help test defenses, automate probing and scale expertise. That is not unique to Claude or OpenAI, and it is not a verdict on one model versus another. But it is a reminder that frontier AI is now part of the attack surface, not just the defense budget. If the industry wants more powerful systems in production, it is also signing up for more powerful pressure on the seams around them.
For OpenAI, the immediate cost is reputational rather than financial. There is no listed share price to punish and no earnings call to absorb the blow. Still, the message to customers and rivals is blunt: even a controlled bug-bounty exercise can expose internal access routes when the target is a fast-moving AI company. In a market where trust is a product feature, that is the kind of story that spreads faster than any patch notice.
