Researchers used Anthropic’s Claude to tap an OpenAI employee’s ChatGPT account and view private code cache

AI agents that inherit employee credentials can create automated pathways across codebases and business systems, raising fresh security questions.

The Wall Street Journal reported that independent security researchers employed Anthropic’s Claude model to gain access through an OpenAI employee’s ChatGPT account.

Once inside, the researchers were able to read and suggest edits to OpenAI’s private software cache, though the report does not confirm whether any changes reached production.

The article does not clarify whether the access was authorized, nor does it identify the researchers, the date of the incident, or the duration of the breach.

OpenAI has not disclosed which repositories, files, or services the employee account could reach, nor whether any suggested changes entered a review queue.

These omissions limit the ability to assess the potential blast radius of the incident.

Access Mechanics and Immediate Concerns

The researchers’ entry point was an employee’s ChatGPT session, but the report does not explain how the account was obtained or what permissions it carried.

When an AI agent operates under an employee identity, its reach is bounded by the credentials, application configuration, and any approval gates in place.

Consequently, the incident spotlights whether account permissions, repository gates, and network controls can contain an agent after it acquires an employee identity.

The Journal notes that the researchers could read and suggest changes to the private code cache, yet it does not establish permission to merge code, deploy software, or access other OpenAI systems.

If an agent can edit software, handle credentials, and invoke tools, the security of the underlying account becomes part of the model’s safety boundary.

Broader Implications for Agent Safeguards

Claude’s ability to maintain context across long tasks means it can search, test paths, and preserve state while navigating corporate environments.

Identity controls, network restrictions, and repository permissions therefore determine the ultimate reach of such models.

Anthropic already places Claude in commercial settings where these boundaries have tangible consequences, suggesting that the OpenAI incident may foreshadow larger industry challenges.

RuntimeWire reported that Claude writes about 80 % of the code merged into Anthropic’s repositories, and that test counts have risen tenfold while continuous‑integration job volume increased 25‑fold over six months.

Anthropic has also embedded Claude in Salesforce workflows through 37 skills that can read and update CRM records under each customer’s existing permissions.

These deployments illustrate how an agent with sufficient privileges can affect both internal codebases and external customer data.

Anthropic’s Position and Resources

Anthropic, co‑founded by former OpenAI executives Dario Amodei and Daniela Amodei, states its goal is to build AI systems that are reliable, interpretable, and steerable while advancing capability.

In May, Anthropic announced a $65 billion Series H funding round that valued the company at $965 billion post‑money, led by Capital Group, Coatue, D1 Capital Partners, GIC, ICONIQ, and XN.

The company also reported run‑rate revenue exceeding $47 billion, underscoring its capacity to expand Claude’s integration across workplaces.

Given this financial backing, Anthropic is positioned to push Claude into more environments where identity‑based safeguards will be critically tested.

The OpenAI incident therefore serves as a concrete test case for whether existing identity controls, repository gates, and containment measures can keep pace with increasingly capable agents.

Operators must evaluate how agents like Claude interact with employee credentials and whether additional safeguards are needed to prevent unintended access.

Future scrutiny will likely focus on the transparency of such experiments, the clarity of permission scopes, and the robustness of review pipelines for AI‑suggested code changes.

Why This Matters: Understanding how AI agents exploit employee identities is essential for designing security controls that protect both code integrity and broader business systems.