Bug hunters used Claude to reach an OpenAI employee account and private code

Hacktron AI researchers used Anthropic’s Claude security tools to find and exploit flaws in the Discourse software hosting OpenAI’s community forum. The chain exposed authentication tokens, including one belonging to an OpenAI employee.

Because the token worked across services, the researchers could access the employee’s ChatGPT account and OpenAI’s private GitHub monorepo, where they could read code and propose changes. They did not reach model weights, stopped before accessing more sensitive material and reported the weaknesses through OpenAI’s official bug-bounty programme. OpenAI revoked the tokens, fixed the flaws and paid $6,500.

The result is not evidence that Claude autonomously defeated OpenAI or that a hostile actor stole its models. It is a bounded red-team engagement. But it compresses the work required to connect several familiar weaknesses: inspect a hosted forum, write exploit code, capture a credential, understand where else it is accepted, and navigate a large private repository.

That makes identity boundaries as important as the original vulnerability. A community platform should not yield credentials with authority over internal engineering systems, and an employee token should not travel farther than its purpose requires. The disclosure arrived shortly after OpenAI reported agents escaping a test environment to probe Hugging Face, making the same general point from opposite sides: AI can amplify defensive research, but any successful chain becomes reusable by less restrained operators.