Three cybersecurity researchers gained unauthorized access to OpenAI Group PBC’s internal GitHub repository by leveraging the AI assistant Claude. The breach occurred in September 2026 and was disclosed to the Wall Street Journal by sources familiar with the incident. The researchers reportedly used Claude to bypass security measures and navigate the repository’s structure, accessing sensitive code related to OpenAI’s artificial intelligence models.
The team exploited weaknesses in access controls, using Claude to generate prompts that helped identify pathways into the system. Once inside, they viewed portions of the repository containing algorithmic details and internal development notes. While the full extent of data viewed remains unclear, sources confirmed the repository included proprietary training methodologies and model architecture specifications. OpenAI has not publicly commented on the breach, but internal reviews are underway to assess potential exposure.
The researchers described using Claude to interpret error messages and suggest alternative routes when initial access attempts failed. By feeding the AI snippets of error logs and system responses, they received guidance on refining their approach. This iterative process allowed them to gradually map internal repositories without triggering immediate alerts. The use of generative AI in this manner highlights a emerging threat vector where attackers leverage LLMs to automate reconnaissance and exploit development.
OpenAI’s GitHub instance reportedly relied on standard authentication protocols that were circumvented through social engineering and AI-assisted probing. Multi-factor authentication was in place for some accounts, but the researchers exploited a service account with elevated privileges that lacked sufficient monitoring. Logging gaps delayed detection, allowing prolonged access before internal security teams noticed anomalous activity. The incident raises questions about the adequacy of current defenses against AI-enhanced intrusion techniques.
How did the researchers initially gain entry to the repository? They obtained credentials through a phishing campaign targeting a contractor with access to OpenAI’s development environment, then used those credentials to log in.
What specific code or data did the researchers access? They viewed files related to model training scripts and internal documentation, though no evidence suggests they exfiltrated or modified core model weights.
Is OpenAI taking steps to prevent similar incidents? Yes, the company has begun reviewing access logs, enforcing stricter service account controls, and exploring AI-based anomaly detection to counter LLM-assisted attacks.