Security researchers disclosed on September 18 that they chained multiple vulnerabilities in an authorized bug-bounty engagement to reach OpenAI employee accounts and submit a harmless pull request inside the company’s internal monorepo. The twist that drove the story viral was their documented use of Anthropic’s Claude model to accelerate reconnaissance and exploit chaining. The episode underscores how quickly AI tooling is being folded into offensive security workflows even inside rival AI labs.

The disclosure came from a small team of independent security researchers who had been participating in OpenAI’s public bug-bounty program. Their report described a multi-stage attack path that began with externally reachable authentication weaknesses and ended with write access to the company’s primary source repository. Because the engagement was authorized and the final action was limited to a benign pull request, OpenAI treated the finding as a valid, high-severity report rather than an incident requiring emergency response.

Attack path in detail

The researchers started by enumerating employee-facing services that were inadvertently exposed through misconfigured SSO redirects. Once they identified a small set of accounts with overly permissive session handling, they used standard phishing lures combined with real-time guidance from Claude to craft convincing pretext messages. Claude helped them iterate on subject lines and technical details that matched internal tooling nomenclature, increasing the likelihood that targets would click through.

After obtaining session tokens, the team moved laterally into internal dashboards that stored repository access credentials. At each step Claude was fed redacted logs and error messages so it could suggest next likely endpoints or parameter names. The model did not directly execute commands; instead it accelerated the researchers’ own decision-making by surfacing patterns they might have missed under time pressure.

Why the story spread so quickly

Two elements combined to make the report unusually shareable. First, the target was OpenAI, a company whose products are themselves the subject of intense public interest. Second, the offensive tooling included a model from Anthropic, OpenAI’s most visible competitor. The optics of one frontier lab’s AI being used to probe another’s internal systems produced immediate commentary across security and AI communities.

Within hours the disclosure thread on X had been viewed several million times. Security practitioners noted that the technique—feeding an LLM sanitized output from each stage of an attack—was no longer theoretical. Several red-team operators posted similar workflows they had tested in private engagements, confirming that the pattern was already in limited use.

Background on the bug-bounty program

OpenAI has maintained a public bug-bounty program for more than two years, inviting researchers to report issues in production services and, more recently, in certain internal tooling exposed through employee workflows. The program explicitly scopes social-engineering attacks when they are conducted against participants who have opted in, which is how the researchers obtained permission to target employee inboxes.

The monorepo in question is the single Git repository that contains the majority of OpenAI’s proprietary model-training code, infrastructure definitions, and internal tooling. Access is gated behind additional hardware-bound credentials, yet the researchers were able to reach a point where they could open a pull request against a non-sensitive documentation directory.

Technical observations shared by the researchers

In their write-up the team emphasized that no zero-day exploits against core infrastructure were required. The chain relied on a combination of:

  • Overly broad OAuth scopes granted to internal dashboards
  • Absence of step-up authentication for repository write actions from employee sessions
  • Insufficient monitoring of Claude-assisted reconnaissance patterns that would have looked anomalous to human analysts

They also released a high-level timeline showing that the entire chain, once the initial employee list was obtained, took less than four hours of active work, with Claude handling a substantial portion of the hypothesis generation.

Industry reaction

Other AI labs have so far declined to comment on whether they are re-evaluating their own use of third-party models inside security operations. Several bug-bounty platform operators noted an immediate uptick in reports that mention LLM assistance, suggesting that researchers are rapidly adopting the technique.

Policy teams inside companies that sell frontier models are now debating whether acceptable-use policies should address offensive-security applications. Current terms from most providers already prohibit using models to cause harm, but the definition of harm becomes ambiguous when the activity is authorized and defensive in intent.

What happens next

OpenAI has stated it is reviewing the specific access-control gaps identified and will update its bug-bounty scope documentation accordingly. The researchers have been awarded the maximum payout tier under the program’s current structure.

More broadly, the episode is likely to accelerate two trends already visible in the industry: tighter integration of AI into both attack and defense tooling, and increased scrutiny of how employee identities are protected when they serve as the gateway to high-value internal assets. Future bug-bounty reports will probably include explicit sections describing any AI tooling used, simply because the detail is now newsworthy.

Whether the use of a competitor’s model remains a headline or becomes routine will depend on how quickly other organizations adopt similar workflows. For now, the September 18 disclosure stands as a concrete data point showing that AI-assisted offensive security has moved from proof-of-concept to production use in high-stakes environments.