Researchers used Anthropic's Claude to penetrate OpenAI systems in a disclosed red-team exercise, according to Ars Technica's September 22 report. The mechanics matter more than the headline: this was not Claude "going rogue," it was operators pointing a capable model at a target and letting it chain reconnaissance, exploit-writing and execution the way a human penetration tester would, just faster and cheaper. That capability is not new to September. What is new is which model did it, and to whom, days after Anthropic shipped Claude Opus 5.5 with what The Verge (September 22) described as tightened cybersecurity safeguards specifically aimed at this kind of misuse.

The part worth sitting with is the direction of the arrow. Security researchers have spent two years warning that any sufficiently capable model can be pointed at a target, OpenAI's own GPT models included. This exercise proves the concern is symmetric: it was not a GPT model attacking Anthropic, it was Claude attacking OpenAI, which means the industry's threat model can no longer treat "our model is the safe one" as a marketing position. Add Google's disclosure the same week (Ars Technica, September 21) that Gemini models were used to hack three companies in May 2026, and the pattern across all three US labs, OpenAI, Anthropic, Google, is the same: the safeguard that matters is not which lab trained the model, it is whether the lab operating the target has agent-level audit logging in place before the attack, not after. Enterprises buying any of these three vendors' API access should read Opus 5.5's tightened controls as a response to this exact scenario, not a routine version bump.