Hacktron, a small security firm, says it hacked into OpenAI by chaining two vulnerabilities, using Anthropic’s Claude to speed up the process. Multiple outlets report the researchers obtained access to several OpenAI employees’ ChatGPT accounts and then moved into OpenAI’s internal software environment.
According to Hacktron and the reporting cited by outlets, the team demonstrated access to OpenAI’s private code repository/software cache within about 72 hours. They say they were able to reach a GitHub-style environment and potentially related systems or connectors after obtaining account access. OpenAI did not dispute the account access described by the researchers, but its focus is on how it patched the issues.
Several outlets note that OpenAI fixed the problems quickly after being notified—one report cites a fix within roughly 14 hours—and paid a $6,500 bug bounty. The extent and framing differ across coverage: some describe the work as “ethical hacking” and emphasize coordination with OpenAI and the community forum operator, while others stress the broader cybersecurity implications of AI tools being used to accelerate attacks. Overall, the incident is presented as another example of vulnerabilities in systems tied to account permissions and community-platform infrastructure.
