What Happened: A Concise Timeline
In early 2026 a modest‑sized cyber‑security research group announced that they had successfully breached OpenAI’s internal defenses. The vector was not a classic phishing campaign or a zero‑day exploit in the traditional sense; instead, the attackers leveraged a legitimate security‑testing application supplied by Anthropic, a rival AI‑research firm.
- Tool Distribution – Anthropic provides a specialized “security professional” tool designed to let vetted researchers probe AI models for weaknesses before malicious actors can weaponize them.
- Credential Compromise – Using the tool, the researchers obtained access to a ChatGPT account belonging to an OpenAI employee. The account contained private code snippets, internal documentation, and early‑stage model‑tuning parameters.
- Data Exfiltration & Recommendations – Once inside, the team read the exposed software information and drafted a set of remediation suggestions, which they submitted through OpenAI’s vulnerability‑discovery program.
OpenAI confirmed the breach, noting that the compromised account was isolated and that no production systems were directly affected. The researchers were compensated per the terms of the bug‑bounty program, though the exact payout was not disclosed.
Technical Breakdown of the Attack
The Anthropic Security Tool
Anthropic’s offering is a sandboxed environment that mimics the behavior of its own language models while exposing a suite of diagnostic APIs. The tool’s primary purpose is to let security analysts:
- Inject crafted prompts to test for prompt injection or jailbreak scenarios.
- Monitor token‑level responses for leakage of proprietary data.
- Run automated fuzzing against model endpoints.
Because the tool runs with elevated privileges on the host machine, it can interact with the user’s local authentication tokens. In this case, the researchers discovered that the tool inadvertently accepted an OAuth token from the OpenAI employee’s ChatGPT session when the employee used the same machine for both Anthropic and OpenAI work.
Exploitation Path
- Token Harvesting – The Anthropic tool queried the local credential store, pulling the OAuth bearer token tied to the employee’s OpenAI session.
- Session Replay – With the token, the attackers recreated the employee’s authenticated session, bypassing multi‑factor prompts that would normally trigger on new devices.
- Privilege Escalation – The employee’s account held “developer” permissions, granting read‑only access to internal repositories and model‑tuning scripts. The attackers used the session to enumerate these assets.
The attack surface was essentially the shared development environment where the same workstation was used for both Anthropic and OpenAI tasks. No vulnerability in OpenAI’s core API was exploited; the breach hinged on credential cross‑contamination.
Mitigation Gaps
- Insufficient Token Isolation – OAuth tokens were stored in a location accessible to any process with user‑level rights.
**Lack of Context‑Aware
Lack of Context‑Aware Token Validation – Tokens were accepted without verifying whether they originated from a trusted Anthropic‑specific client, allowing a token issued for OpenAI to be reused by the Anthropic tool.
Insufficient Device Fingerprinting – Multi‑factor authentication (MFA) was only triggered on new device signatures. Because the attacker replayed the token on the same workstation, the MFA challenge was bypassed.
Shared Workstation Policies – The environment permitted simultaneous use of Anthropic and OpenAI credentials on a single machine, violating the principle of least privilege for high‑risk accounts.
Recommendations for OpenAI and Anthropic
🔹 ------
• Recommended Action: -------------------
• Rationale: -----------
🔹 *Token Storage*
• Recommended Action: Move OAuth tokens to a hardware‑backed keystore (e.g., TPM or Secure Enclave) and restrict access to processes signed by the issuing vendor.
• Rationale: Prevents cross‑application token harvesting.
🔹 *Context‑Aware Validation*
• Recommended Action: Require the client ID and audience claim to match the issuing service before accepting a token for privileged actions.
• Rationale: Stops reuse of tokens across unrelated services.
🔹 *Device‑Based MFA*
• Recommended Action: Enforce MFA on every session that originates from a new process, even if the device fingerprint matches a known workstation.
• Rationale: Reduces reliance on static device IDs.
🔹 *Workstation Segmentation*
• Recommended Action: Implement mandatory profile separation for developers working on competing AI platforms (e.g., separate user accounts or virtual machines).
• Rationale: Limits credential spillover between projects.
🔹 *Audit Logging*
• Recommended Action: Expand logs to capture token acquisition events, including the requesting binary and its signature hash.
• Rationale: Improves forensic visibility for future incidents.
🔹 *Bug‑Bounty Scope Clarification*
• Recommended Action: Clearly delineate which tools and environments are in‑scope for vulnerability research to avoid accidental misuse of testing utilities.
• Rationale: Aligns researcher incentives with safe testing practices.
Both companies have already pledged to roll out patches addressing the most critical gaps within the next quarter.
Read the full breakdown originally published at https://ltdeveloperblogs.github.io/posts/researchers-used-claude-to-hack-openai/
Top comments (0)