{
  "id": 8258421,
  "title": "Hackers breach OpenAI using Claude tools, gaining access to employee accounts and the company's internal codebase — attackers initiated a 'harmless' pull request as proof of the hack",
  "url": "https://urgent.news/2026/09/18/hackers-breach-openai-using-claude-tools-gaining-access-to-employee",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-18T13:45:00.000Z",
  "source": {
    "name": "Tom's Hardware",
    "slug": "tom-s-hardware",
    "url": "https://www.tomshardware.com/tech-industry/cyber-security/hackers-breach-openai-using-claude-tools-gaining-access-to-employee-accounts-and-the-companys-internal-codebase-initiating-a-harmless-pull-request-as-proof-of-the-hack"
  },
  "original_language": "en",
  "account": "Hackers from cybersecurity firm Hackron AI successfully breached OpenAI using Claude tools, gaining access to employee accounts and internal code. They exploited a single sign-on misconfiguration and a Remote Code Execution flaw in Discourse, OpenAI's community discussion platform. The attack began with a malicious HEIF image uploaded as a profile picture, triggering a heap overflow memory vulnerability and remote code execution. The hackers then hijacked session tokens to impersonate an OpenAI employee and access internal accounts, including GitHub and email. Within 72 hours, OpenAI fixed the vulnerabilities and rewarded the researchers with a $6,500 bounty.",
  "summary": "A team of white-hat hackers from cybersecurity startup Hackron AI has successfully hacked OpenAI using Claude tools.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Scientific American",
        "title": "What does OpenAI’s blockbuster mathematics proof mean for the real world?",
        "url": "https://urgent.news/2026/09/18/what-does-openais-blockbuster-mathematics-proof-mean-for-the-real",
        "published": "2026-09-18T18:00:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}