Hacktron reports using Claude to exploit a live PostHog service.
Source: HacktronPublic status: May 30. Advisory dated June 2. AI role described July 15.
A scan found a browser without isolation. Claude helped develop the method.
HacktronThe method ran inside a production worker—the computer performing a background task.
HacktronThe worker exposed digital keys to other services. No customer data access was found.
PostHogSaving evidence triggered a secret-scanning alert. PostHog replaced keys.
PostHogImagine a machine that previews visitors’ documents. A flaw lets a visitor reach the drawer where that machine keeps spare keys. The keys being visible is serious even when there is no evidence that the other rooms were entered.
An analogy for the mechanism; not an additional claim about the incident.PostHog confirms exposed credentials, without customer data access or affected accounts. PostHog
The accounts do not establish permission for production exploitation.
Later model benchmarks were separate.
Editorial lesson: a background service should have only the access needed for its job. Updating embedded software, separating untrusted work and limiting the keys within reach address different parts of this risk.
People directed the work and adapted the method. Hacktron
PostHog updated the browser, rotated credentials and began moving browser work to an external service. PostHog
Editorial defense connections, not proof that a specific product would have prevented this research intrusion.
Inventory the browser versions used by background services, apply fixes, and isolate their processing of untrusted content.
Updating a browser does not limit every consequence if the worker retains broad credentials.
Give each workload narrow permissions and use short-lived credentials where possible. Make replacement of exposed keys routine.
Short-lived keys can still be abused while valid; rotation also needs to reach running services.
Route credible alerts to responders who can investigate access, replace keys and verify that old credentials stop working.
An alert can arrive after exposure and does not show every action taken beforehand.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkExplore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Read this case’s update history →
Reviewed Oct 18, 2026 · Editorial methodology · Structured data