Researchers used Claude to hack OpenAI

What happened

Security researchers have demonstrated that Anthropic's Claude model could be used to breach OpenAI employee accounts and reach sensitive data stored on GitHub, according to reporting from Ars Technica, The Register and The Verge. The exercise — described by outlets as an exploit chain nicknamed "HEIF Heist" — reportedly saw Claude leveraged as part of an attack path that ultimately compromised employee ChatGPT accounts and exposed access to internal code repositories.

The disclosure sits within the growing field of AI red-teaming, where researchers probe how AI assistants and agents can be manipulated or weaponised to bypass conventional account and data protections, rather than being exploited through a traditional software vulnerability alone.

Why it matters

The case illustrates how capable AI assistants are increasingly becoming both a target and a tool in security research: an assistant designed to help with everyday tasks can, under the right conditions, be steered into facilitating account compromise and data exposure. For organisations racing to deploy AI agents across engineering, support and operations, this is a reminder that agentic AI systems inherit — and can amplify — the access and trust boundaries of the accounts and platforms they touch.

For technology and security leaders, the episode reinforces that AI adoption cannot be separated from identity, access management and monitoring strategy. As AI assistants are given broader permissions to act on employees' behalf, the attack surface shifts from purely technical exploits toward manipulation of the assistant's reasoning and workflow — a risk category many enterprise security programmes are still not built to detect.

The Renascence take

Most coverage of this story will focus on the technical mechanics of the exploit. The more durable lesson is about trust design: employees and systems alike are being conditioned to treat AI assistants as trusted intermediaries, and that trust is exactly what this kind of research exploits.

Every new AI assistant an organisation deploys effectively becomes a new identity with its own access footprint — yet most companies still govern it like a productivity tool rather than a privileged account. The behavioral fix isn't just technical hardening; it's rethinking the default trust employees place in AI-mediated actions, from approving a login to sharing a repository link. Operators serious about safe AI adoption should treat every agentic assistant as a new insider risk profile, with the same scrutiny, monitoring and least-privilege discipline applied to human employees — not an exemption from it.