Three Indian cybersecurity researchers have made headlines after using Anthropic's Claude while investigating security flaws in OpenAI's systems.
The researchers — Harsh Jaiswal, Mohan Pedhapati and Rahul Maini — were not trying to carry out an illegal cyberattack. They were working under OpenAI's bug bounty programme, where security researchers are allowed to look for vulnerabilities and report them to the company.
What makes the case interesting is the role played by AI.
Claude helped the researchers with parts of their technical work, including writing and debugging code. The incident shows how AI tools are starting to change the way experienced security researchers find and test vulnerabilities.
Who are the three Indian researchers?
The three researchers are associated with Hacktron AI, a cybersecurity company.
Mohan Pedhapati, the company's CTO and co-founder, has experience in areas including web security, source-code analysis and vulnerability research.
Harsh Jaiswal, another Hacktron AI co-founder, has worked in cybersecurity and vulnerability research for more than a decade.
Rahul Maini is also an experienced security researcher who has worked with bug-bounty and penetration-testing platforms.
According to the India Today report, Jaiswal led the OpenAI research with Pedhapati and Maini.
Their work eventually uncovered multiple security issues that could be connected together.
How did the OpenAI security research begin?
The researchers started by looking at OpenAI's public community forum.
They found a vulnerability connected to the way certain image files were processed by the forum.
According to the report, the flaw could potentially be used for code execution on the forum's server.
This was one of the points where Claude became useful.
Rather than doing every coding and debugging step manually, the researchers used Claude to help write and modify code and work through errors during their investigation.
But saying that Claude hacked OpenAI on its own would be misleading.
The researchers were directing the investigation. They had to understand the systems, identify useful vulnerabilities and decide how different weaknesses could be connected.
Claude was helping with the technical work.
One vulnerability led to another
The investigation reportedly uncovered another weakness involving login tokens.
According to the report, the issue could provide access to OpenAI employee accounts.
The researchers then found a route that eventually reached an OpenAI private GitHub environment through an employee's Codex account.
This part of the incident is important because major security breaches do not always happen because of one huge vulnerability.
Sometimes, several smaller weaknesses can be connected.
A flaw in one part of a system may provide an initial entry point. Another weakness can then increase access. If those weaknesses are chained together, the impact can become much larger.
That is what made this research significant.
It reportedly took less than 72 hours
The speed of the research is another part of the story that has attracted attention.
According to India Today, the researchers went from finding the initial vulnerability to reaching the private repository in less than 72 hours.
They reportedly spent less than $3,000, around ₹2.5 lakh, on AI tokens during the research.
After the vulnerabilities were reported, OpenAI fixed them and paid the researchers a $6,500 bug bounty, roughly ₹5.5 lakh.
The numbers give an idea of how inexpensive AI-assisted technical research can become when experienced researchers use these tools effectively.
Of course, the cost of AI tokens was only one part of the equation. The researchers already had the cybersecurity knowledge needed to understand what they were looking at.
Claude was a tool, not the hacker
The phrase "Indians hacked OpenAI using Claude" makes for a strong headline, but there is more to the story.
Claude did not independently decide to target OpenAI.
It did not wake up and start searching for vulnerabilities without human direction.
The researchers chose the target as part of an authorised security programme. They identified the weaknesses and decided what to test next.
Claude helped them perform some of the technical work.
That distinction matters as AI becomes more common in cybersecurity.
An AI model can write code, explain code, suggest fixes and help a researcher investigate a problem. But that does not automatically make the AI an autonomous cyber attacker.
The level of human involvement still matters.
Why cybersecurity researchers are using AI
Security research can involve a lot of repetitive work.
A researcher may need to understand an unfamiliar codebase, write scripts, test different inputs, debug errors and document findings.
AI assistants can help with some of these tasks.
For an experienced researcher, this can save time.
Instead of spending a long time fixing a small coding problem, for example, a researcher can ask an AI assistant for possible solutions and then test them.
The researcher still needs to check whether the answer is correct.
That is an important point. AI-generated code can contain mistakes. In cybersecurity, blindly trusting an AI-generated suggestion can create its own problems.
The value comes from combining human security expertise with AI assistance.
The same technology can create new risks
There is another side to this development.
The tools that help ethical hackers can also be useful to people with malicious intentions.
If AI makes it easier to analyse code, create scripts and troubleshoot technical problems, some cybercriminals may also try to use those capabilities.
That could make the job of security teams harder.
Companies already have to defend against phishing, malware, stolen credentials and software vulnerabilities. As AI becomes more capable, they will also have to consider how attackers could use AI to speed up their activities.
At the same time, defenders can use AI for threat detection, code analysis and vulnerability discovery.
So the technology can work on both sides.
What this means for bug bounty programmes
Bug bounty programmes have become an important way for technology companies to find security problems before criminals discover them.
Researchers search for weaknesses, report them to companies and can receive financial rewards for valid findings.
AI could change how quickly researchers can work through these programmes.
A researcher who previously spent several days on repetitive technical tasks may be able to complete parts of that work much faster with an AI assistant.
That could result in more vulnerabilities being discovered and reported.
But it could also mean companies receive security reports at a faster rate and need stronger systems for reviewing and fixing them.
Why the Indian connection matters
The involvement of three Indian cybersecurity researchers has also brought attention to India's security research community.
India has a large pool of developers, engineers and cybersecurity professionals working with global technology companies and bug-bounty platforms.
As AI becomes part of everyday development and security work, people who understand both AI and cybersecurity could become increasingly valuable.
The combination is particularly interesting because AI systems themselves are becoming part of the software infrastructure companies need to protect.
The bigger question is about AI and cybersecurity
It would be easy to look at this incident and simply say that Claude helped three researchers hack OpenAI.
The reality is more interesting.
The researchers already had the skills to investigate vulnerabilities. Claude helped them move through some parts of that process faster.
That could become a common model for cybersecurity in the coming years.
AI may not replace security researchers. Instead, it could become another tool in their toolkit — much like automated scanners, debugging tools and code-analysis software are today.
The bigger question is how both sides use that technology.
Security teams can use AI to find vulnerabilities before attackers do. Attackers can potentially use AI to search for weaknesses faster too.
For companies, that means security cannot remain a one-time exercise.
Systems need to be tested, monitored and updated continuously.
And as AI becomes more capable, the speed of that security race is likely to increase.
Source: India Today, September 20, 2026.