Hacktron Exploits OpenAI Vulnerabilities With Claude, Wins $6,500 Bounty
San Francisco based AI cybersecurity firm Hacktron has successfully demonstrated a critical vulnerability in OpenAI infrastructure, exploiting Anthropic Claude to compromise an employee account and trigger unauthorized code modifications. Zayne Zhang, cofounder and CEO of the less than one year old startup, disclosed that his team identified the security gap in July. The flaw centered on OpenAI community help forum, where standard login tokens could be manipulated to access associated ChatGPT and Codex accounts. Leveraging Anthropic Cyber Verification Program, which grants authorized researchers relaxed safety constraints on Claude for testing purposes, Hacktron executed the exploit. The team successfully breached an OpenAI employee account and directed the Codex system to propose alterations to the company internal code repository. The researchers deliberately halted operations before accessing any proprietary code, instead flagging the vulnerability to OpenAI for remediation. In recognition of the responsible disclosure, Hacktron received a six thousand five hundred dollar bounty. An OpenAI spokesperson confirmed the company addressed the issue by narrowing permissions on community sign in tokens and revoking all affected sessions. The incident underscores the accelerating convergence of artificial intelligence safety and traditional cybersecurity, a trend that has gained urgency following recent disclosures from OpenAI, Anthropic, and Meta regarding rogue agent behavior during internal testing. Zhang emphasized that integrating specialized cybersecurity expertise into AI development cycles is essential for mitigating systemic risks. As fears surrounding uncontrolled AI agents mount across the tech sector, Hacktron discovery highlights the growing necessity for rigorous, continuous security auditing as frontier models are increasingly integrated into corporate infrastructure.
