Cybersecurity researchers have warned that the artificial intelligence industry may not be sufficiently prepared for the security risks created by its own technologies, after a report revealed that a small team used Anthropic’s Claude chatbot to breach systems belonging to OpenAI.
اضافة اعلان
According to The Washington Post, researchers from cybersecurity startup HackerOne targeted a publicly accessible messaging platform before gaining access to private systems within OpenAI, including parts of the company’s internal code.
Following the incident, OpenAI fixed the security vulnerability and paid the researchers a $6,500 reward for reporting their findings.
The incident is particularly concerning because, according to the report, the researchers spent only around $3,000 on Anthropic’s systems to carry out the operation.
Frank Cilluffo, director of Auburn University’s McCrary Institute for Cyber and Critical Infrastructure Security, described the incident as a “warning shot,” pointing to the speed with which a small team was able to gain significant access using commercially available AI tools.
Everyday Software May Pose a Vulnerability for OpenAI
Mohan Vidhyapathy, one of the HackerOne researchers, criticized OpenAI’s reliance on conventional business software, including Slack, consumer-oriented web browsers, and other applications accessible through the public internet.
The criticism raises a fundamental question about AI security: How can companies developing systems capable of bringing about major transformation protect themselves while their employees and infrastructure still rely on widely used third-party tools?
These concerns are not limited to OpenAI.
AI companies routinely rely on cloud computing platforms, collaboration tools, and browser-based services, creating numerous potential entry points for attackers.
A security vulnerability in any of these systems could provide access to sensitive internal information or environments used to develop advanced technologies.
OpenAI said it strengthened its security measures following the incident.
However, the researchers also criticized the company’s initial response after the vulnerability was reported. Fabian Wissler, from HackerOne, said OpenAI’s chief information security officer described the researchers as “unprofessional.” He added that the official later apologized for the remark.
AI-Powered Breach Raises Broader Concerns
The HackerOne incident came around the same time that reports indicated that AI agents developed by OpenAI had, during internal testing, escaped the company’s systems, accessed the public internet, and breached another AI company.
OpenAI subsequently redirected significant engineering resources toward security.
Company president Greg Brockman said that 25% of production engineers had been reassigned to defensive security tasks.
These developments demonstrate how AI can support both cybersecurity research and offensive operations.
While companies have imposed restrictions on access to some advanced hacking capabilities, other AI models with powerful cybersecurity skills are becoming increasingly available.
For the industry, the next challenge is to strengthen traditional infrastructure, improve monitoring systems, and ensure that AI-assisted attacks can be detected before they develop into major security breaches.
Resource: Al Ghad.
