Researchers used Anthropic’s Claude to hack into OpenAI

Security researchers demonstrated a novel attack chain in which they turned one AI company's flagship model against a rival, using Anthropic's Claude to probe and ultimately breach OpenAI's internal systems. The operation moved from reconnaissance to account takeover to unauthorized repository access, exposing a cross-vendor vulnerability path that the AI industry had not publicly documented before.

This piece breaks down exactly what was compromised, which teams and organizations face similar exposure, and what engineers and security leads should verify today. It is written for builders, security practitioners, and technology leaders who depend on OpenAI's platform or who operate AI-assisted tooling inside their own infrastructure.

What broke in Researchers used Anthropic's Claude to hack

The researchers used Claude as a capable reasoning engine to identify and chain together weaknesses in OpenAI's systems, ultimately seizing control of employee accounts. From those accounts they pivoted inward, gaining access to an internal code repository — the kind of asset that typically holds proprietary model code, infrastructure configuration, and deployment tooling. Account takeover at the employee level represents a critical failure because modern organizations grant staff accounts elevated trust by default: single sign-on connections, broad read permissions on internal tools, and the implicit authority to trigger automated pipelines.

The code repository access compounds the account compromise significantly. Internal repositories frequently contain secrets that were never meant to leave the organization — API keys, environment variables, internal service endpoints, and architectural documentation. Even read-only access to such a repository can give an attacker a detailed map of a target's systems. The researchers disclosed the vulnerabilities to OpenAI before publishing, meaning the flaws were patched through a coordinated process rather than exploited maliciously in the wild.

Who is exposed by Researchers used Anthropic's Claude to hack

OpenAI is the immediate organization named in this incident, but the exposure pattern extends outward. Any company that operates employee accounts connected to sensitive repositories through standard identity-federation flows — and that is essentially every software organization — faces a structurally similar risk. What distinguishes this case is the attacker's toolkit: a commercially available AI assistant was sufficient to locate and exploit the vulnerability chain, lowering the barrier for future actors who might replicate the technique without the same research intent.

Organizations that have adopted AI coding assistants or AI-driven security tools inside their own environments should pay particular attention. These tools are typically granted read access to codebases, issue trackers, and internal wikis as a matter of function. If a threat actor can leverage an external AI to compromise one employee account with similar permission scopes, the downstream blast radius — repositories, secrets, internal documentation — mirrors what the researchers reached inside OpenAI.

What to do now about Researchers used Anthropic's Claude to hack

Security teams should immediately audit the permission scope attached to employee accounts that have any connection to internal code repositories. Least-privilege enforcement is the most direct mitigation: accounts should not carry standing access to repositories they do not actively need, and service accounts used by AI tooling should be scoped tightly and rotated on a schedule. Organizations running AI assistants with codebase access should review whether those tools can themselves be manipulated through prompt-injection or adversarial inputs that redirect their actions.

Repository access logging and anomaly detection should be reviewed for gaps. The researchers reached an internal repository from a compromised account, which means detection opportunity exists at the authentication layer, the access-control boundary, and the repository activity log simultaneously. Any environment where those three log streams are not correlated in a SIEM or equivalent system has reduced visibility into this attack pattern. Enabling alerts on first-time repository access by a given account credential and on access outside normal working hours are low-cost steps available in most identity and source-control platforms today.

How the Researchers used Anthropic's Claude to hack issue works

The technique centers on repurposing an AI assistant as a vulnerability-discovery and exploitation engine aimed at a separate organization. Claude, designed as a general reasoning and coding tool, proved capable of analyzing targets, identifying weaknesses in authentication or authorization flows, and guiding or executing steps in an account-takeover sequence. The significance is not that Claude contains a dedicated attack module — it does not — but that its general capability is high enough that a researcher willing to frame requests appropriately can direct it toward offensive tasks.

This represents a meaningful shift in the threat model for AI-adjacent systems. Previously, cross-company AI attacks were largely theoretical. This incident establishes a concrete proof of concept: a publicly available model from one vendor can serve as the instrument for compromising a different vendor's internal systems. The attack surface is not the model itself but the combination of the model's reasoning ability, the attacker's framing, and the target organization's existing vulnerability posture.

What is still unknown about Researchers used Anthropic's Claude to hack

The public record does not yet specify which particular vulnerabilities were chained together to achieve the account takeover, how long the researchers maintained access before disclosure, or which specific internal repository was reached. The scope of what was visible inside that repository — whether it included model weights, deployment infrastructure details, or customer-adjacent data — has not been confirmed in available reporting. Whether OpenAI's disclosure and patching process addressed all identified weaknesses, or whether the researchers surfaced a subset of what Claude helped locate, also remains unclear.

It is similarly unknown whether other research teams or threat actors have independently developed comparable techniques against OpenAI or other AI companies, and whether the vulnerability classes involved are idiosyncratic to OpenAI's environment or are present across the industry. The incident raises unresolved questions about responsible disclosure norms when the tool used to discover vulnerabilities belongs to a direct competitor of the target — a dynamic with no established precedent in the security community.