How 3 Indian researchers used Claude to hack OpenAI

Artificial intelligence is changing more than the way software is written. It is also changing how quickly security vulnerabilities can be found, tested and exploited — and a recent exercise involving three Indian-origin researchers offers a sharp example of that shift.

Researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini from cybersecurity startup Hacktron AI used Anthropic’s Claude during an authorised security exercise involving OpenAI. In less than 72 hours, they went from identifying vulnerabilities to demonstrating access to multiple OpenAI employee accounts and a route into an internal code repository. The researchers disclosed the findings to OpenAI, which fixed the issues and later paid a $6,500 bug bounty.

The headline takeaway may be that “Claude hacked OpenAI”. The more important story, however, is how AI is shrinking the amount of specialised time and expertise needed for advanced cybersecurity work.

Claude became the force multiplier

Hacktron's research began with OpenAI’s public community forum, which uses the open-source Discourse platform. The team found a vulnerability in the image-processing chain involving the libheif library and used Claude to help investigate the flaw and develop a working exploit.

The researchers first worked with Claude Opus 4.8. Hacktron said it struggled to produce a reliable exploit under the target’s security protections. After Claude Opus 5 was released, the team gave the model the same problem and said it succeeded within hours.

From there, the researchers identified a separate weakness in OpenAI’s single sign-on system. That created a path from the forum compromise to active ChatGPT and Codex accounts. To demonstrate the impact without accessing sensitive internal code, the team used an affected employee’s Codex account to create a harmless pull request in OpenAI’s internal monorepo before stopping the test.

Crucially, this was not an autonomous Claude attack. Humans selected the target, investigated the vulnerabilities, connected the different weaknesses and decided when to stop.

From OpenAI to Gemini: AI is now part of the attack chain

The Hacktron episode comes as Google has disclosed a different kind of AI-security incident.

In May 2026, during a cybersecurity evaluation conducted by independent firm Irregular, Google’s Gemini model accessed the internet and breached the systems of three real companies. In one case, Gemini guessed passwords; in two others, it found credentials in a public repository and used them to access protected systems, according to Reuters. Google said Gemini stopped its activity in all three cases after determining that the targets were real companies.

That episode is fundamentally different from Hacktron’s research. Here, the AI model itself was carrying out the cyber activity during a controlled test, rather than human researchers using AI as an assistant.

Google said the incidents highlighted the importance of training powerful AI systems to act responsibly, while Irregular said the testing problems had been fixed.

The cybersecurity economics are changing

Hacktron said the OpenAI exercise took a few days of agent work and only a few hours of human time. Its broader HEIF Heist research project, which ran for two months and examined multiple companies and software ecosystems, cost less than $3,000 in AI tokens in total.

That is the bigger warning for businesses. Security through complexity has traditionally relied partly on the fact that exploiting a known vulnerability could require rare expertise, considerable time and an understanding of the target environment. Hacktron argues that AI is removing some of that barrier by turning scarce expertise into compute.

And the same technology can work on the other side of the fence. Google has now launched its Fairwind programme, giving selected governments and enterprises access to Gemini-based tools designed to autonomously find and fix vulnerabilities.