Three Attackers Exploit Claude to Breach OpenAI in Under 72 Hours

Researchers in security reported that three hackers succeeded in infiltrating OpenAI's internal infrastructure by leveraging the Claude AI model, finishing the intrusion in less than three days. First reported by Gizmodo, the episode highlights the escalating danger that openly accessible generative AI tools can be turned toward malicious purposes.

The probe found that the perpetrators employed Claude—Anthropic’s AI chatbot—to produce code fragments and automate functions that would typically demand an experienced developer. By instructing the model to create scripts that could circumvent authentication checks, the intruders traversed OpenAI’s network and exfiltrated non‑public information. From the first test to the final data pull, the whole process took under 72 hours.

OpenAI acknowledged that the breach was narrowly scoped and that no essential infrastructure was affected. Officials stressed that the compromised material excluded proprietary model weights and user‑generated content, and that operations suffered no disruption. Still, the incident has triggered an immediate internal audit of the use of external AI services within development pipelines.

Experts in security argue the case exemplifies a wider pattern in which generative AI systems, intended to aid programmers, can unintentionally serve as weapons for malicious actors. “When an AI can produce working code on command, it reduces the hurdle for advanced attacks,” observed a cybersecurity analyst who wished to stay unnamed. The analyst further explained that the issue lies not in the AI per se, but in insufficient safeguards surrounding how firms embed such tools into their workflows.

OpenAI disclosed intentions to reinforce its security measures, such as limiting third‑party AI assistants on critical systems and broadening surveillance for irregular code‑generation behavior. The firm also aims to work with peers across the industry to craft best‑practice standards for secure AI application in software development.

The breach comes as regulators and policymakers intensify their examination of AI’s security ramifications. Legislators in multiple regions have urged the establishment of clearer rules for deploying generative models, particularly in high‑risk fields. As the technology advances, striking a balance between harnessing AI for efficiency and protecting against its abuse remains a pressing challenge for the tech sector.