Claude Opus 5 used to take over OpenAI staff accounts in test

Three researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to take over the ChatGPT and Codex accounts of several OpenAI employees, and from there reach an internal OpenAI code repository, according to a report published on 19 September 2026 by The Hacker News.

The researchers chained two separate flaws. The chain began with a bug in the software that runs OpenAI's public help forum, according to the report. It then moved through a weakness in OpenAI's own login system. Combined, the two issues were enough to reach staff accounts on ChatGPT and Codex, OpenAI's coding product, and then an internal code repository.

The report describes the work as security research. Hacktron is a security firm, and the account takeovers were carried out as part of authorised testing rather than a criminal intrusion. No evidence has been reported of anyone else exploiting the same chain, and the report does not say how many employee accounts were affected beyond describing them as several.

The detail that will interest people building and defending agent systems is the role of the model. Claude Opus 5, Anthropic's model, was used by the researchers to help assemble the chain, according to the report. That places the work in a growing category of vulnerability research in which a large language model does part of the analysis that a human researcher would otherwise do by hand. The report does not break down how much of the chain the model found on its own and how much came from the three researchers directing it.

The underlying pattern is familiar to anyone who has looked at account takeover chains before. A public-facing, lower-priority system — here, a help forum running third-party software — is treated as separate from the main product, but the identity layer connects them. Once the login system can be persuaded to issue access, the distinction between a support site and a production coding tool stops holding.

The Hacker News report does not state whether OpenAI has fixed the two flaws, when they were reported to the company, or whether a bounty was paid. OpenAI has not published a statement on the research in the material reviewed for this article. Anthropic, whose model was used in the testing, is not described as a party to the research.

For teams running agents with access to code repositories, the case is a reminder that an agent account is a production credential. Codex accounts belonging to staff led, in this chain, to internal source code. Access controls that assume a human is typing at the other end need to hold when the account is an agent's.