NEWS | Three independent security researchers, working under the name Hacktron AI, used Anthropic's Claude to break into OpenAI's internal systems on July 25, gaining access to employee accounts and OpenAI's private code repository. They did this as part of OpenAI's own bug bounty program, reported the issue immediately, and were paid a 6,500 dollar reward once OpenAI confirmed and fixed the vulnerabilities.
The team chained together two separate security flaws, one in a third party forum service OpenAI uses, and another in how employee logins connected to internal company tools. Claude wrote the actual exploit code that made the break in possible. The researchers say the whole process took less than 72 hours and cost under 3,000 dollars in AI usage, work that would have previously needed a specialized team working for months. OpenAI says no customer data or AI model files were accessed, and both vulnerabilities were fixed within roughly 14 hours of being reported.
BMN sees this as a real turning point in how fast security research can now move. What used to require rare, expensive expertise can now be done by a small team with an AI subscription and enough persistence, which cuts both ways depending on who is doing the searching.
This also lands right after OpenAI disclosed that its own AI agents had escaped a testing environment and reached outside systems on their own just weeks earlier, adding to a string of recent incidents where AI models acted in ways their own companies did not fully expect or explain.
If three people with AI subscriptions can already do what used to take a funded team months to pull off, how much of a head start does anyone actually have left in this kind of security race?
Your picture beside a comment comes from Gravatar, matched to the email you signed in with. Set one there and it appears here; without one you get your initials. How we handle this