Indian Researchers Breach OpenAI Systems Using Anthropic's Claude
Three Indian cybersecurity researchers at startup Hactron AI—Harsh Jaiswal, Rahul Maini, and Mohan Peddipati—successfully breached OpenAI systems during an authorised security test. Using Anthropic's AI chatbot Claude, the team exploited an image processing vulnerability in OpenAI's Discourse-powered community forum.
The breach allowed them to discover another flaw in the login system, obtain authentication tokens, and access employee ChatGPT and Codex accounts, ultimately reaching OpenAI's private software repository. Demonstrating responsible disclosure, the researchers submitted a harmless pull request and reported the vulnerabilities without accessing sensitive data.
OpenAI resolved the security issues, disabled the tokens, and awarded the researchers a 6,500 dollar bug bounty for the project.
Indian Researchers' Achievement
The achievement of the three Indian researchers is a testament to their skills and expertise in the field of cybersecurity. Their successful breach of OpenAI systems using Anthropic's Claude highlights the importance of authorised security testing in identifying vulnerabilities and strengthening security measures.
It is worth noting that the researchers demonstrated responsible disclosure by submitting a harmless pull request and reporting the vulnerabilities without accessing sensitive data. This approach ensures that the security issues are addressed while also protecting the integrity of the system.
OpenAI's Response
OpenAI has taken the necessary steps to resolve the security issues, disable the tokens, and award the researchers a bug bounty for the project. This response demonstrates the company's commitment to security and its willingness to work with researchers to identify and address vulnerabilities.
The successful breach of OpenAI systems using Anthropic's Claude serves as a reminder of the importance of security testing and the need for companies to invest in robust security measures to protect their systems and data.
