A team of cybersecurity researchers at Hacktron managed to gain access to OpenAI accounts after finding vulnerabilities involving the company's community forum. The group used Claude, a language model from Anthropic, to find weaknesses in software used by the Discourse platform that hosts OpenAI’s community forum. They initially tried to exploit the flaw but were unsuccessful on the first attempt.
The researchers said an earlier Claude model struggled to turn the vulnerability into a working attack. Anthropic released the more advanced Claude Opus 5 later that day. The Hacktron team then used the newer model to help develop a working exploit.
The following day, Hacktron gained access to ChatGPT and Codex accounts belonging to some users who had used the forum. Some of the affected accounts belonged to OpenAI employees. Once inside, the researchers could view conversations between users and OpenAI's AI tools.
Mohan Pedhapati, one of the researchers involved, said that anything a user discussed with ChatGPT could potentially be seen by someone with that level of account access. He explained that the access could also extend to connected apps like email, Slack and GitHub.
Hacktron said the researchers did not read or download OpenAI's internal source code. To demonstrate the seriousness of the vulnerability, they used an employee's Codex account to create a harmless proof-of-concept pull request in an internal OpenAI repository. They then stopped further testing and reported the issue.
This type of activity is part of a broader category called bug bounty programs, where companies pay ethical hackers to find vulnerabilities, according to CBS News. OpenAI has offered several such rewards for security flaws in its systems.
The Hacktron research was conducted by Pedhapati, Harsh Jaiswal and Rahul Maini. Pedhapati said that performing a similar attack by himself without help from advanced AI could have taken two to three months. The actual Hacktron investigation took less than 72 hours.
He said newer AI models have made it easier for skilled hackers to perform these kinds of attacks. According to Pedhapati, the process could now take less than a day with current tools. He warned that companies should assume they are vulnerable and design their systems accordingly. He added that many AI labs are not doing enough to protect against such threats.
Hacktron did not need to directly attack OpenAI’s source code to gain access. Instead, the researchers found a vulnerability involving a software dependency used by the Discourse forum and combined it with a problem involving OpenAI's sign-in system.
This approach shows how interconnected systems can be exploited even if a company's main software is not the initial point of entry. Hacktron said third-party services can create a path into more sensitive systems when login credentials and connected services are shared.
The researchers reported the flaw through OpenAI's bug bounty program. Hacktron said OpenAI fixed its side of the problem about 14 hours after the initial report.
OpenAI told CBS News that it narrowed the permissions available to Community sign-in tokens and revoked affected tokens and sessions. Hacktron received a $6,500 bounty for the OpenAI-related finding. OpenAI said testing against the Discourse-hosted community forum itself was not covered by its bounty program.
Discourse was also notified. Hacktron said the company prepared a fix within days and added additional protections around image processing.
One major concern is that AI models themselves could be stolen. The model weights that make these systems powerful are especially valuable to adversaries. Experts have long been concerned about the possibility of foreign actors or criminals stealing such models.
Nicholas Leiserson, a cybersecurity policy expert at the Institute for Security and Technology, said that AI technology is now considered relevant to national security. He noted that governments around the world have increasingly treated the security of advanced AI systems as an important issue.
The Hacktron researchers said the incident shows how quickly advanced AI can reduce the time and resources needed for sophisticated cybersecurity research. Their work also shows that the same tools that help defenders find security problems could make it easier for malicious hackers to exploit them.
The incident underscores how quickly AI tools can be used to compromise even large tech companies. It also highlights the security risks created when one account provides access to multiple connected services.