OpenAI reports hackers from China and Iran using ChatGPT for malware
OpenAI reported that hackers from China and Iran have used ChatGPT to create malware, debug code, and conduct phishing attacks. The company said it disrupted over 20 malicious operations exploiting its models, though it found no evidence of significantly increased hacking capabilities or substantial new malware creation resulting from AI use.
What happened
OpenAI identified that the Chinese-origin hacker group SweetSpect used its models to support offensive cyber operations and conduct phishing attacks by impersonating ChatGPT users seeking technical support, thereby infecting and controlling devices.
The Iranian threat actor STORM-0817 used OpenAI's models to debug code and assist in programming a new Android malware still in development with basic surveillance capabilities, and employed ChatGPT to build its command and control infrastructure.
OpenAI reported interrupting over 20 malicious cyber operations and deception networks attempting to exploit its models, with activities ranging from creating social media posts to debugging malware.
Reported impact
OpenAI stated it detected no evidence of significant increase in cybercrimal capabilities to exploit real-world vulnerabilities, substantial creation of new malware, or formation of viral audiences through AI use.
Deceptive social media campaigns using the models reached large audiences, though OpenAI noted the interest focused on the alleged use of AI itself rather than actual AI implementation.
Index analysis
OpenAI observed in October 2024 that cybercrinals use AI models for intermediate-phase activities, specifically after acquiring basic tools such as email accounts or social media, but before distributing final products like social media posts or malware programs.
Governance controls
OpenAI implemented restrictions and deployed measures to interrupt malicious operations exploiting its models, as detailed in its Influencia y operaciones cibernéticas report intended to help the company anticipate and plan effective law enforcement measures.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.