Technology newsroom
Shocking! Researchers Use AI Claude Opus 5 to Breach OpenAI, Seizing Employee Accounts and Accessing Internal Code 🤖💥
Security researchers from Hacktron used AI Claude Opus 5 to discover and chain two vulnerabilities in OpenAI's system, successfully allowing them to seize employee accounts and access the internal code repository. This is an interesting case study on using AI in penetration testing.
📌 Key Highlights:
- Security researchers from Hacktron used Anthropic's AI model Claude Opus 5 to assist in discovering and chaining vulnerabilities in OpenAI's system.
- This research successfully seized multiple ChatGPT and Codex accounts belonging to OpenAI employees.
- The vulnerabilities originated from a small bug in a public help forum, which was then chained to a weakness in the login system, ultimately granting access to OpenAI's internal code repository.
This marks another highly interesting case study in the cybersecurity industry. Three researchers from the security firm Hacktron demonstrated AI's potential in assisting with vulnerability discovery. They utilized Anthropic's renowned AI model, Claude Opus 5, as a tool to penetrate OpenAI's systems, a direct competitor.
⛓️ Chained Flaws Attack Technique
This system breach did not stem from a single critical vulnerability but rather from cleverly chaining two minor vulnerabilities. The starting point was a bug found in the software OpenAI uses for its public help forum, which appeared to pose no high risk. However, the research team used Claude Opus 5 to analyze and find a way to link this bug to another weakness within OpenAI's own login system.
🔐 Impact
The successful chaining of the two vulnerabilities allowed researchers to gain control of multiple ChatGPT and Codex accounts belonging to OpenAI employees. More concerningly, they also managed to access OpenAI's Internal Code Repository. However, all these actions were part of authorized security research, and the vulnerabilities have already been reported to OpenAI for remediation. This incident demonstrates that even giant tech companies can have overlooked vulnerabilities, and AI is becoming a powerful tool for both offensive and defensive cybersecurity.
💬 How much do you think AI will play a greater role in cyberattacks and defenses in the future? Let's share your thoughts.