OpenAI Discloses State-Sponsored Misuse of ChatGPT for Cyber Operations

Saturday, March 14, 2026 at 02:00 PM UTC·Source: OpenAI Threat Intelligence

Updated: Sunday, March 15, 2026 at 08:00 AM UTC

Executive Summary

OpenAI reports disrupting five state-sponsored groups using ChatGPT for reconnaissance, phishing content generation, and malware debugging.

Analysis

OpenAI disclosed that it disrupted accounts linked to five state-sponsored threat actors from China, Iran, North Korea, and Russia using ChatGPT for cyber operations support. Activities included target reconnaissance, phishing email drafting, malware code debugging, and social engineering script development. OpenAI emphasizes that AI provided incremental capability improvements rather than breakthrough capabilities. The company has enhanced its detection systems for coordinated inauthentic usage patterns.

Source Attribution

Originally published by OpenAI Threat Intelligence on Mar 14, 2026. Verified by: OpenAI.

Related Threats

LOWApt

Cloudflare’s new CMS is not a WordPress killer, it’s a WordPress alternative

Cloudflare on Wednesday rolled out EmDash, which it described as “the spiritual successor to WordPress.” The security vendor positioned EmDash as a far more secure site building tool that avoids the extensive cybersecurity problems with WordPress plugins . But the Cloudflare claims go far beyond cybersecurity issues. The vendor is arguing that the very nature of websites in 2026 is sharply differe

4h agoCSO Online

MEDIUMApt

Apple Rolls Out DarkSword Exploit Protection to More Devices

The DarkSword exploit kit has been used by both state-sponsored hackers and commercial spyware vendors. The post Apple Rolls Out DarkSword Exploit Protection to More Devices appeared first on SecurityWeek .

13h agoSecurityWeek

HIGHApt

New Whitepaper: Stealthy BPFDoor Variants are a Needle That Looks Like Hay

Executive Overview Advanced persistent threats (APTs) are constantly and consistently changing tactics as network defenders plug holes in defenses. Static indicators of compromise (IoCs) for the BPFDoor have been widely deployed, forcing threat actors to get creative in their use of this particular strain of malware. What they came up with is ingenious. New research from Rapid7 Labs has uncovered

16h agoRapid7