Claude helped hackers take over an OpenAI employee account

What happened

On September 18, 2026, security researchers, often called white-hat hackers, reported they used Anthropic's Claude to assist in breaching an OpenAI employee's ChatGPT account. This allowed them to access internal tools, which included GitHub code, and, in some accounts, connected services like Slack and email.

The method involved exploit chaining, where several small problems are linked to create a larger vulnerability. The chain reportedly began with an image handling bug that could crash an image decoder library. Under specific conditions, this crash could lead to remote code execution. From there, the researchers reportedly leveraged a weakness related to sign-in sessions, often referred to as single sign-on (SSO).

The team stated they conducted this responsibly, disclosing the vulnerabilities to OpenAI, waiting for fixes, and receiving a $6,500 bug bounty payment. A three-person team used one company's chatbot to break into another company's AI systems in under three days.

Why it matters

This incident highlights how AI tools like Claude can accelerate the exploit development process, potentially compressing the time required for hackers to identify and chain vulnerabilities. The reported speed of under three days to achieve a breach involving multiple steps underscores a shift in the efficiency of cyberattacks.

The concept of exploit chaining, particularly in the context of single sign-on systems, reveals a critical vulnerability point. While SSO offers convenience, it consolidates access, meaning a compromise at one point can grant wide-ranging entry. This makes the integrity of every link in the authentication chain paramount.

The breach of an OpenAI employee account specifically and access to internal tools signals that AI companies, despite their advanced technology, are not immune to sophisticated attacks. Their security posture depends not just on model safety but also on the robustness of their surrounding infrastructure, from image decoders to login systems. This event serves as a practical demonstration of AI's dual-use nature, extending to offensive cybersecurity.

What to watch next

• How AI companies publicly address the role of AI in aiding such exploits.
• New security measures implemented around image processing libraries and single sign-on systems.
• Whether other white-hat teams report similar AI-assisted hacking attempts against major tech firms.
• Changes in bug bounty programs to reflect the increased efficiency AI tools bring to vulnerability discovery.

What this means for you

Business leaders and operators must re-evaluate their cybersecurity strategies in light of AI's growing role in both defense and offense. This incident suggests that traditional vulnerability assessments may not fully account for the speed and complexity of AI-assisted attacks. Focus on strengthening fundamental security hygiene across all systems, especially those that enable single sign-on, as these represent consolidated points of failure.

Prioritize comprehensive security audits that specifically look for exploit chains rather than isolated bugs, assuming that an attacker may use AI to connect seemingly disparate vulnerabilities. Given that an image handling bug initiated this chain, all third-party libraries and integrations should be scrutinized. Invest in robust incident response capabilities, as the speed of AI-boosted attacks means detection and containment must be equally swift.

Key takeaways

• Anthropic's Claude reportedly helped hackers breach an OpenAI employee account.
• The attack involved "exploit chaining," linking an image handling bug to an SSO weakness.
• Access to internal tools like GitHub, Slack, and email was reportedly gained.
• The white-hat team disclosed the vulnerabilities and received a $6,500 bounty.
• This demonstrates AI's capacity to boost the speed and efficiency of hacking efforts.

FAQ

How did hackers use AI to break into OpenAI?

Hackers reportedly used Anthropic's Claude to help them chain together multiple vulnerabilities, starting with an image handling bug that led to remote code execution. This was then reportedly combined with a single sign-on (SSO) weakness to access an OpenAI employee's ChatGPT account and subsequently internal systems such as GitHub, Slack, and email. The AI tool is said to have aided in compressing the time required for this multi-step exploit.

What kind of vulnerabilities were exploited in the OpenAI hack?

The reported hack on OpenAI involved exploiting an image handling bug, specifically one that could crash an image decoder library and lead to remote code execution. Following this initial compromise, a weakness related to single sign-on (SSO) sessions was reportedly leveraged. These two vulnerabilities were "chained" together to gain broader access to an OpenAI employee's account and connected internal tools.

What is exploit chaining in cybersecurity?

Exploit chaining in cybersecurity refers to the process of linking together multiple, often individually minor, vulnerabilities or weaknesses to achieve a more significant compromise. As demonstrated in the OpenAI incident, one vulnerability, such as an image handling bug, can create an entry point, which is then used to exploit another weakness, like a single sign-on flaw, to escalate access or privileges.

Was the OpenAI hack disclosed responsibly?

Yes, the security researchers who reportedly conducted the hack on OpenAI stated they did so responsibly. They disclosed the vulnerabilities to OpenAI, waited for the necessary fixes to be implemented, and subsequently received a $6,500 bug bounty payment. Their actions were consistent with white-hat hacking practices focused on improving security rather than causing harm.