Source : INDIA TODAY NEWS
In July, three Indian-origin cybersecurity researchers used Anthropic’s Claude to hack into OpenAI’s systems. It was an authorised security test in which the researchers used Claude to help exploit a software flaw, eventually gaining access to OpenAI employee accounts and a way into the company’s private GitHub environment. Simply put, the researchers were looking for security flaws in OpenAI’s systems as part of its bug-bounty programme. They found one and used Claude to help exploit it. The three researchers were Harsh Jaiswal, Mohan Pedhapati and Rahul Maini, from cybersecurity startup Hacktron AI.
advertisement
According to the report by WSJ, the entire experiment took less than 72 hours, from finding the first vulnerability to gaining access to an OpenAI private repository. These researchers reportedly spent less than $3,000 (around Rs 2.5 lakh) on AI tokens during the test, and OpenAI later fixed the vulnerabilities and paid the team a $6,500 (around Rs 5.5 lakh) bug bounty.
But who are these three researchers, and what is their connection to India?
Indian researchers who used Claude to hack OpenAI
The three researchers are Mohan Pedhapati, Harsh Jaiswal and Rahul Maini, who all work at cybersecurity startup Hacktron AI. They have spent years finding software vulnerabilities, testing systems and participating in bug-bounty programmes. According to Hacktron, the OpenAI research was led by Jaiswal, alongside Pedhapati and Maini.
Mohan Pedhapati: Pedhapati is the CTO and co-founder of Hacktron AI. He is a security researcher specialising in web exploitation, source-code review and mobile application security. Before Hacktron, he founded Electrovolt Infosec and worked as a security consultant at Cure53. He also worked as a data science intern at Eigen Vectors, where he explored recurrent neural networks for speech recognition. Pedhapati studied computer science at RGUKT Nuzvid, where he completed his BTech between 2015 and 2021. Before that, he attended ZPPHS Sampathnagar High School,Andhra Pradesh, India from 2013 to 2015.
Harsh Jaiswal: Jaiswal is a co-founder of Hacktron AI and a vulnerability researcher with more than 10 years of experience finding security flaws. Before Hacktron, he worked as a security engineer and researcher at Project Discovery, Zomato and Cure53. He has also worked as a bug-bounty researcher with HackerOne. His work has included finding vulnerabilities in products and platforms from companies such as Apple, PayPal and GitHub. He has also worked with Maini on security research in the past.
Rahul Maini: Maini is a vulnerability researcher at Hacktron AI and has a long history in the bug-bounty community. His previous experience includes Cobalt, Synack Red Team, HackerOne and Bugcrowd, where he worked as a core pentester or bug hunter. He has also received recognition from the security community, including an AT&T Hall of Fame mention, a Bugcrowd community award and a first runner-up position at TCS HackQuest 3.0. Maini studied computer science at Bharati Vidyapeeth, Delhi, India from 2015 to 2019.
How did they hack OpenAI using Claude?
These three researchers were testing OpenAI’s systems for security flaws as part of its bug-bounty programme when they found a vulnerability in the company’s public community forum. The flaw was linked to the way the forum handled certain image files and could allow someone to run code on the forum’s server.
The team then reportedly used Anthropic’s AI chatbot Claude to help investigate the vulnerability and develop a working exploit. Claude helped with tasks such as writing, debugging and adapting the exploit, which made the process much faster.
The researchers also found another weakness that allowed them to use login tokens to access OpenAI employee accounts. This eventually gave them a path into the company’s private GitHub environment through an employee’s Codex account. The researchers, rather than Claude, connected the different vulnerabilities and decided how to use the access they obtained.
In simple terms, the researchers found a security flaw in OpenAI and used Claude to help turn it into a way to break into the system.
– Ends
SOURCE :- TIMES OF INDIA
