Meet 3 Indian researchers who hacked OpenAI using Claude
What's the story
Three Indian-origin researchers, Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini, have made headlines after successfully hacking into OpenAI using Anthropic's Claude. The trio works at Hacktron AI, a cybersecurity startup with researchers who have a history of uncovering critical vulnerabilities in major tech companies. They discovered the vulnerability while probing OpenAI's community forum on July 23. After promptly reporting their security findings to OpenAI, the three ethical hackers were awarded a $6,500 (approx. ₹6.22 lakh) bug bounty.
Attack details
Researchers accessed internal code and employee authentication information
The researchers first targeted a public-facing messaging board and then gained access to OpenAI's private systems, including some internal code.
They exploited a vulnerability in how the forum processed certain image files and found another flaw in OpenAI's single sign-on system.
This gave them authentication information tied to ChatGPT and Codex accounts of OpenAI employees, as well as access to an internal code repository.
Industry reaction
Experts weigh in on potential attack risks
In response to the incident, Pedhapati said OpenAI's reliance on off-the-shelf business software like Slack and consumer-grade web browsers makes it an easy target for potential attacks.
Cybersecurity experts have also weighed in on the matter. Joshua Saxe, CTO of AI security firm Abundant Security, emphasized this incident highlights the difficulty of protecting corporate secrets in an era of AI hacking.
Profiles
Meet the team behind the breach
Jaiswal, a co-founder of Hacktron AI, has over 10 years of experience in finding critical vulnerabilities across platforms. He has worked as a security engineer and researcher at Project Discovery, Zomato, and Vimeo.
Maini is a vulnerability researcher with an AT&T Hall of Fame mention and Bugcrowd community award under his belt.
Pedhapati is the co-founder and CTO of Hacktron AI who previously founded Electrovolt Infosec and served as a security consultant at Cure53.