Security Researchers Used Claude to Help Them Hack into OpenAI

A team of independent security researchers claims to have successfully breached OpenAI employee accounts in under 72 hours, utilizing Anthropic's Claude Opus 4.8 and 5 models. The incident, reported by The Wall Street Journal, highlights potential vulnerabilities in third-party services. The three-person team from Hacktron gained access to OpenAI's GitHub repository, dubbed "Monorepo," which sources suggest contains "OpenAI's algorithmic secrets." While the researchers stopped short of directly accessing internal code within Monorepo, they demonstrated their unauthorized entry by submitting a pull request from an employee's Codex account. The entry point for the breach was identified as Discourse, a third-party service that hosts OpenAI's community forums. This method of access underscores the risks associated with integrating external platforms, even for seemingly peripheral functions. The rapid nature of the breach, achieved with AI assistance, raises questions about the evolving landscape of cybersecurity threats.