3 Indian-origin cybersecurity researchers used Claude to hack OpenAI:Within 72 hours, they did entire process and spent less than ₹2.5 lakh on AI tokens

In July, three Indian-origin cybersecurity researchers used Anthropic’s Claude to help test OpenAI’s systems and exploit security flaws. The work was part of OpenAI’s authorised bug-bounty programme, where security researchers are invited to find and report vulnerabilities. The researchers, Harsh Jaiswal, Mohan Pedhapati and Rahul Maini, work at cybersecurity startup Hacktron AI. During their test, they found a flaw in OpenAI’s public community forum and used Claude to help turn the discovery into a working exploit. Their research eventually gave them access to OpenAI employee accounts and a route into the company’s private GitHub environment. According to The Wall Street Journal, the entire process took less than 72 hours. The researchers spent less than $3,000 (around Rs 2.5 lakh) on AI tokens during the test. OpenAI later fixed the vulnerabilities and paid the team a $6,500 (around Rs 5.5 lakh) bug bounty. But who are the three researchers behind the discovery, and what do we know about their backgrounds? Who are the three Indian researchers? The research was led by Harsh Jaiswal, with Mohan Pedhapati and Rahul Maini working alongside him. All three are part of Hacktron AI and have experience in vulnerability research, penetration testing and bug-bounty programmes. Mohan Pedhapati Mohan Pedhapati is the CTO and co-founder of Hacktron AI. His work focuses on areas such as web security, source-code analysis, and mobile application security. Before starting Hacktron, Pedhapati founded Electrovolt Infosec and worked as a security consultant at Cure53. He also worked as a data science intern at Eigen Vectors, where he explored the use of recurrent neural networks for speech recognition. Pedhapati studied computer science at RGUKT Nuzvid in Andhra Pradesh, completing his BTech between 2015 and 2021. He earlier studied at ZPPHS Sampathnagar in Andhra Pradesh. Harsh Jaiswal Harsh Jaiswal is a co-founder of Hacktron AI and has more than a decade of experience in vulnerability research. Before Hacktron, he worked with companies and security organisations including Project Discovery, Zomato and Cure53. He has also worked as a bug-bounty researcher with HackerOne. His research has involved security flaws in products and platforms belonging to companies such as Apple, PayPal and GitHub. He has also previously worked with Rahul Maini on security research. Rahul Maini Rahul Maini is a vulnerability researcher at Hacktron AI and has been active in the bug-bounty community for years. His previous work includes roles with Cobalt, Synack Red Team, HackerOne, and Bugcrowd, where he worked on penetration testing and vulnerability research. Maini has also received recognition from the cybersecurity community. His achievements include an ATT Hall of Fame mention, a Bugcrowd community award and a first runner-up position at TCS HackQuest 3.0. He studied computer science at Bharati Vidyapeeth in Delhi, completing his degree between 2015 and 2019. How did they use Claude to test OpenAI? The researchers were looking for security weaknesses in OpenAI’s systems through its bug-bounty programme when they discovered a flaw in the company’s public community forum. The vulnerability was connected to the way the forum processed certain image files. In some circumstances, it could allow an attacker to run code on the forum’s server. The team then brought Claude into the process. The AI chatbot helped them with parts of the technical work, including writing, debugging, and modifying the exploit code. This allowed the researchers to test different approaches more quickly. However, Claude did not independently carry out the entire attack. The researchers found the vulnerabilities, guided the investigation, and decided how the different pieces of access could be connected. From a forum flaw to OpenAI’s private systems The researchers later discovered another weakness involving login tokens that could be used to access OpenAI employee accounts. They eventually found a route into OpenAI’s private GitHub environment through an employee’s Codex account. This is where the human researchers played an important role. While Claude helped with technical tasks, the researchers were responsible for identifying the vulnerabilities, understanding what the access meant, and deciding how to proceed with the authorised security test.