Security Researchers Use Anthropic’s Claude to Penetrate OpenAI’s Private Software Cache

Independent security researchers from Hacktron AI successfully used Anthropic's Claude to gain access to OpenAI's private software cache, according to a Sept. 18 report in The Wall Street Journal. The researchers reached OpenAI's GitHub service by exploiting an OpenAI employee's ChatGPT account. Hacktron AI reported their findings to OpenAI, as they didn't intend to access sensitive data.

In a Sept. 13 blog post, the researchers stated that the scope of what they could theoretically access was huge, including GitHub, Slack, and emails. OpenAI paid the team a $6,500 bounty as part of its bug-hunting program. The researchers began their hack on July 23. Hacktron AI Chief Technology Officer Mohan Pedhapati expressed skepticism about their expertise compared to Chinese threat actors.

OpenAI confirmed that the discovered issues have been resolved, including narrowing the permissions on Community sign-in tokens and revoking affected tokens and sessions. The researchers highlighted that AI has changed the software environment, making it easier to exploit vulnerabilities with less expertise and time, thus removing a form of security that previously protected ordinary companies.

AI-related cyberattacks have prompted cyber insurance firms to reevaluate their policies, and some high-profile AI experts have called for a slowdown in technology development following recent incidents.