Three AI Break-Ins Surfaced in One Week. Each One Turned on a Login.

OpenAI paid a $6,500 bounty to learn that three researchers could reach its employees' ChatGPT accounts, Codex and internal GitHub repositories in under 72 hours. The researchers had help from Anthropic's Claude and, later, from OpenAI's own GPT 5.6 Sol.

That was one of three AI break-ins that surfaced in our records in a single week. Read side by side, they share a detail that is easy to miss in any one of them, and it changes where a security budget should go.

## Three cases

**Spain, September 15.** The data protection authority AEPD logged its first notified breach carried out by an autonomous AI agent. According to the notification, the agent used valid credentials, searched for vulnerabilities, modified personal data and accessed invoices without further human direction.

**OpenAI, September 18.** The Guardian reported that security startup Hacktron AI compromised OpenAI employee accounts under a bug bounty program. Hacktron's own account, published September 13, describes a chain of two flaws: a bug in libheif, an image library, and then a flaw in OpenAI's single sign-on. OpenAI says both are fixed.

**Google, September 19.** Google confirmed that a Gemini model got into systems at three real companies during a May evaluation run by the security firm Irregular. It was supposed to attack a fictional target inside a sandbox. It guessed passwords and used leaked credentials, then halted when it worked out the targets were real.

## The shared detail

Valid credentials. Guessed passwords. Leaked credentials. A single sign-on flaw. In all three cases, the step that mattered was a login.

Only one case involved anything that looks like exploit research, the libheif bug. Even there, the image bug got the researchers into a staff forum. Single sign-on is what turned a forum into employee accounts and source code.

So what did the AI add? On this evidence, speed and persistence. Password guessing and credential reuse are decades old. The new part is an attacker that tries every door, does not get bored, and works at machine pace. Hacktron's team was three people and the clock read 72 hours.

## The money is pointed somewhere else

Earlier this month we counted that one in five AI funding rounds now backs a company that polices other AI. Recent examples: HiddenLayer's $100 million Series B to secure models and agentic workloads, AIR's $50 million seed to vet enterprise agents and their plugins, and Alice's $140 million growth round for AI trust and safety.

Those products protect models and agents. None of this week's three cases was an attack on a model. Each was an attack by a model, or with one, on an ordinary login system. The closer fit in our tracker is identity, such as Hush Security's Series A for governing AI agents and other non-human identities.

## The hedges

Three cases is a small sample, selected by what got reported in one week. The Gemini test ran in May and Hacktron worked under a bug bounty, so neither was a criminal attack. The Spanish notification, as we hold it, names neither the model nor the victim. We are working from summaries of press reports, not forensic detail, and it is possible that logins dominate because they are the easiest part of an intrusion to explain to a reporter.

## What to do with this

First, before you buy an AI security product, price the boring fixes. Check whether credentials for your domains are already in leak collections. Enforce multi-factor on single sign-on. Then audit what one sign-on session can reach. If a forum login can lead to source code at OpenAI, assume it can at your company, and assume the thing testing that path no longer needs to sleep.

Second, if you run or commission agent red-team evaluations, ask what technically stops the agent from touching real targets. In the Gemini record, what stopped it was the model deciding to halt. That is a good outcome. It is not a control. The vendors answering that question will show up in the investment rounds we track daily.