Independent security researchers managed to exploit a flaw using Claude, developed by Anthropic, to gain access to OpenAI's internal systems, as reported by The Wall Street Journal. This incident allowed the team to read files and propose modifications in a private software repository, accessing a company collaborator's account on ChatGPT.
The discovery was made by a team from Hacktron AI, which was participating in a bug bounty program established by OpenAI itself—a program designed to protect researchers seeking vulnerabilities in the company's systems. Upon reporting the finding, the team received compensation of $6.5 thousand, equivalent to approximately R$ 34.7 thousand.
This event is part of a recent sequence of occurrences involving the use of artificial intelligence (AI) tools in digital intrusions. The case also highlights a growing debate about the dangers posed by AI systems that can assist individuals with different levels of technical knowledge in exploiting security flaws.
Access to Internal Code Repository
The researchers identified that certain tokens enabled access to OpenAI's code system, named 'Monorepo'. Sources familiar with the organization's structure, cited by the Journal, described this repository as a vast collection of software containing OpenAI's algorithmic secrets. This system is compared to the company's 'secret recipe' because it holds the code that optimizes the speed and efficiency of its models.
However, the Monorepo does not store model weights, which are considered even more sensitive. These weights consist of trillions of numbers located at the core of large language models, being crucial for systems to decide which information should be emphasized or ignored.
Through the ChatGPT interface, the researchers were able to read the documents stored in the Monorepo. The team ended the activity after confirming access to confidential data, but before that, performed an action to prove the system's reach: they instructed the chatbot to generate a pull request, which is a suggested change to a file in the repository.
The proposed change aimed to modify a guidance document to include the terms 'Hacktron AI Team PoC' and a link to the X profiles of Mohan Pedhapati, CTO of Hacktron AI, and Harsh Jaiswal, head of research at the company. However, the researchers reported that this modification was not accepted. OpenAI, in turn, communicated that its analysis on GitHub detected only 'limited reads' of private repository metadata and code changes.
The company also informed that the researchers found two distinct vulnerabilities: one in Discourse and another inherent to OpenAI itself. In response, OpenAI stated: 'We thank the researchers for contacting us and sharing their findings. We have reduced the permissions of community login tokens and revoked the affected tokens and sessions.'
Industry Implications and Reactions
For Mohan Pedhapati, the incident illustrates the potential that advanced cybersecurity teams, when supported by governments, possess to access secrets related to AI. This concern intensifies amid the dispute between the United States and China over leadership in AI development. Pedhapati commented: 'I don't think we are as strong as Chinese threat actors.' He added: 'We are just three guys with Claude and Codex subscriptions.'
Joshua Saxe, CTO of Abundant Security, analyzed the Hacktron report, stating that the case demonstrates the growing difficulty in protecting corporate systems in the age of AI-assisted attacks. Saxe observed that 'The world's software is full of security flaws. The reason we haven't discovered them all is that until last year, there were only a few thousand people specialized in finding these flaws.' According to him, AI agents are democratizing this capability, making it accessible to people with less technical knowledge.
The cybersecurity firm ThreatDown reported that criminals are also accessing similar resources, indicating that access to accounts with enhanced functionalities for cyber activities can be illegally acquired on online forums for about $800 (approximately R$ 4.3 thousand).
The OpenAI episode occurred just two weeks after a series of AI agents escaped containment mechanisms and attacked Hugging Face. These new incidents happen while industry executives debate the need to slow down AI progress. On Saturday (12), Sam Altman of OpenAI and other industry leaders advocated for a pause in technological advancement, arguing that development is happening too rapidly for companies to safely mitigate risks.
Additionally, on Wednesday (16), OpenAI disclosed previously undisclosed security incidents and established new guidelines for communicating these events. Following the attack on Hugging Face and the intrusion carried out by Hacktron researchers, OpenAI initiated a security audit of its systems. Greg Brockman, president and co-founder of the company, confirmed that a considerable portion of its engineers was mobilized for this task. Brockman stated: 'We took 25% of our production engineers and told them: 'Sorry, all your projects are suspended. Now you are on defense.'' He added that the review identified 'a series of serious issues,' which were subsequently corrected.