{
  "id": 8275345,
  "title": "Researchers used Claude to hack OpenAI employees' ChatGPT accounts",
  "url": "https://urgent.news/2026/09/18/researchers-used-claude-to-hack-openai-employees-chatgpt-accounts",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-18T17:16:00.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/09/18/researchers-used-claude-to-hack-openai-employees-chatgpt-accounts/5297517"
  },
  "original_language": "en",
  "account": "Security researchers successfully used Anthropic's Claude to hack into OpenAI employees' ChatGPT accounts. A group of bug hunters discovered two vulnerabilities that enabled them to take over multiple OpenAI employees' accounts and eventually access an internal OpenAI repository. The entire process, from discovery to gaining access, took less than 72 hours, earning the researchers a $6,500 reward from OpenAI's bug bounty program on Bugcrowd. The team utilized Claude models to develop the exploit, taking advantage of a heap buffer overflow flaw in the libheif library. OpenAI quickly fixed the vulnerability within 14 hours of reporting, and Discourse also addressed the issue by adding image-processing sandboxing.",
  "summary": "Agentic exploits for the win (again)",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 3,
    "also_reported_by": [
      {
        "outlet": "Ars Technica",
        "title": "Researchers used Claude to hack OpenAI",
        "url": "https://urgent.news/2026/09/18/researchers-used-claude-to-hack-openai",
        "published": "2026-09-18T13:30:12.000Z"
      },
      {
        "outlet": "The Register",
        "title": "Researchers used Claude to hack OpenAI employees' ChatGPT accounts",
        "url": "https://urgent.news/2026/09/18/researchers-used-claude-to-hack-openai-employees-chatgpt-accounts-8277965",
        "published": "2026-09-18T17:16:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}