Researchers Used Anthropic's Claude to Breach OpenAI, Seizing Employee Accounts and Code Repo

Security researchers turned Anthropic's Claude into an intrusion tool and used it to break into OpenAI's internal systems, commandeering employee accounts and reaching an internal code repository, according to a report from TechCrunch. The flaws were reported to the affected company rather than exploited for gain, making the episode a demonstration of how one lab's model can be pointed at another lab's defenses. The breach raises immediate questions about the security posture of AI companies that hold some of the industry's most valuable code and model weights.

The details that matter are the access path, not the model choice. According to the account, the researchers chained Claude through steps that ended with control of OpenAI staff accounts, then used that foothold to reach a code repository kept off the public internet. Employee accounts are the soft underbelly of any large technology company: they carry single sign-on privileges, cloud console rights and access to internal tooling that perimeter defenses are built to protect. Once an attacker holds a working session, the repository is often a few clicks away.

That an Anthropic model was the instrument is the wrinkle that will travel furthest. AI labs increasingly run their own red teams and hire outside firms to stress-test their systems, and frontier models are now good enough at reading code, spotting misconfigurations and drafting convincing messages to be useful in that work. The same capability, pointed the other way, is an offensive tool. The story is less about vendor rivalry than about a maturing attack surface: models that can reason across a codebase are exactly what an intruder wants when hunting for a way in.

For OpenAI, the practical exposure is limited if the findings were disclosed and fixed before publication, which the reporting indicates. The reputational exposure is harder to contain. A company that sells trust in its systems now has a public example of its own accounts and repository being reachable by an outside team using a competitor's product. Enterprises weighing AI vendors will read the episode as a reminder that internal access controls, not model quality, decide how much damage a breach can do.

What happens next depends on disclosure. Neither lab has detailed the specific vulnerabilities, and it is unclear whether the account takeover relied on a flaw in OpenAI's own systems or on weaknesses in third-party identity tooling that many companies share. If the latter, the finding is bigger than one company and will force a broader audit of how AI firms gate access to their most sensitive assets. The open question is whether this stays a red-team anecdote or becomes the template for the next round of AI-industry intrusions.