Researchers at the cybersecurity startup Hacktron AI gained access to ChatGPT accounts belonging to OpenAI employees using an Artificial Intelligence model (TN, AI) from Anthropic, according to a post published today on the startup’s website.
The breach, which took place in late July and was confirmed to Agence France-Presse by OpenAI, was part of an exercise conducted by the company itself to identify vulnerabilities in its systems with the help of external IT experts.
ΣΧΕΤΙΚΑ ΑΡΘΡΑ
Canadian Anne Carson Wins the Nobel Prize in Literature
A Look Back at Apollon’s International Soccer Players
To achieve its goal, the three-person team used the Discourse messaging platform, which is used by OpenAI.
Discourse allows employees to log in to their ChatGPT or Codex accounts—OpenAI’s AI for programming.
Using this method, the researchers were able to gain access to many of these accounts.
To the extent that a user can grant ChatGPT or Codex permission to use multiple applications or files, “the range of those we could theoretically access is enormous,” explained the three-member team.
They cited GitHub (a code hosting platform), Slack (a business messaging platform), and emails.
The description of the Hacktron AI team’s work highlights the rapid progress of artificial intelligence models.
The team members began their intrusion attempt with the help of Claude Opus 4.8, a model released by Anthropic in May. But this AI “struggled” to find a point of entry through Discourse.
Coincidentally, Anthropic released a new model, Opus 5, on the same day. This new AI model managed to find the security vulnerability “within three hours,” according to these cybersecurity experts.
The team quickly notified OpenAI, which fixed the security vulnerabilities, according to a spokesperson.
“We thank the researchers who contacted us and shared their findings,” a spokesperson told Agence France-Presse.
This exercise confirms the growing capabilities of artificial intelligence in the field of cybersecurity.
In early April, Anthropic decided not to widely release the Mythos model, deeming it too dangerous for cybersecurity.
It restricted access to a few companies and organizations so they could use it to identify and fix security vulnerabilities in their software.
Anthropic released a limited version of Mythos, called Fable, in June. A few days later, the U.S. government suspended Fable, citing a national security risk, before finally approving it two weeks later.
READ ALSO: One million files, missing persons, and videos of a woman being strangled: A house of horrors in Philadelphia, owned by a photographer | AlphaNews
Source: KYPE
