The bounty hunters just became the thing they're hunting — and that should scare you more than the hack itself.
The Summary
- Hacktron, a sub-10-person SF cybersecurity startup, used Anthropic's Claude to find and exploit vulnerabilities in OpenAI's infrastructure, earning a $6,500 bug bounty after gaining access to an OpenAI employee's Codex account
- The exploit targeted OpenAI's community help forum login tokens, creating a vector to employee accounts and internal code repositories
- Anthropic's Cyber Verification Program explicitly relaxed Claude's safety guardrails for "authorized security research" — meaning the AI that helped execute this hack had its ethics leash loosened by design
The Signal
Hacktron's CEO Zayne Zhang is testing a thesis that should keep you up at night: if his tiny team can use one frontier AI to probe another's defenses, what happens when malicious actors automate this at scale? The answer arrived faster than anyone expected. His team leveraged Anthropic's Cyber Verification Program, which gave Claude modified permissions to conduct security research, and pointed it at OpenAI's community forum authentication system.
The vulnerability chain was elegant. OpenAI's help forum used login tokens that carried overly broad permissions. Hacktron's Claude-assisted tooling identified that any user logging into the forum could have their ChatGPT and Codex accounts compromised. From there, the team escalated to an OpenAI employee account and successfully prompted that employee's Codex instance to suggest changes to OpenAI's internal code repository. They stopped before accessing actual code and reported the issue. OpenAI paid out $6,500 and revoked the affected tokens.
"Any user or OpenAI employee logging into OpenAI's community help forum could have had their ChatGPT and Codex accounts hacked."
That bounty amount tells you everything. $6,500 is what you pay a college kid who finds a broken form validation. For a vector into your internal code repository at the world's most valuable AI company, it's insultingly low. Either OpenAI's bug bounty program hasn't caught up to the severity of AI-era exploits, or they're severely underpricing the risk of agent-assisted attacks. Both options are bad.
Here's the deeper problem: Anthropic built an official program to let researchers disable Claude's safety constraints for cybersecurity work. That's not controversial on its face. Red teams need tools that can probe like attackers. But it creates a permission structure that's one forged API key away from being a weapon. If Claude can find these gaps when it's allowed to, what's stopping a jailbroken version from doing the same?
Key dynamics at play:
- The attacker and the attacked are now using the same class of tools — frontier AI models
- Safety guardrails are situational, not structural. They can be lowered with the right authorization.
- Bug bounties haven't adapted to agent-era threat models. The economics are still stuck in 2019.
Zhang's framing is telling. He's not positioning this as "we found a bug." He's positioning it as "we're investigating whether frontier AI companies have gaps that AI agents could exploit." That's a fundamentally different question. It's not about whether your login form has an XSS vulnerability. It's about whether your entire security posture can withstand automated, intelligent, tireless adversaries that iterate faster than your patch cycles.
The Implication
If you're building anything in the agent economy, assume your security model is already obsolete. The cat-and-mouse game just became cat-and-cat, and the mice are us. Watch for three things: expanded bug bounty programs with AI-appropriate payouts, new security frameworks designed for agent-vs-agent threat models, and a sharp uptick in automated penetration testing services selling Claude-style tools to both sides of the security market.
The real tell will be whether OpenAI and Anthropic start disclosing agent-assisted security incidents separately from traditional bugs. If they don't, you'll know they're not ready for what's coming.