OpenAI took action against STORM-0817, an Iran-linked threat group, by banning accounts that were using its AI models to debug Android malware, scrape data from social media platforms, and translate hacking tools. The accounts were detected and removed from the platform as part of OpenAI's effort to prevent malicious use of its services. This enforcement demonstrates OpenAI's ongoing efforts to identify and block state-linked actors attempting to abuse generative AI for cybercriminal and espionage activities.
OpenAI terminated accounts linked to SweetSpecter, a suspected China-based cyber group, which had been using the platform's AI to research security vulnerabilities, generate malicious code, and craft spear-phishing messages. The group's activities were detected and documented by OpenAI's threat intelligence team working with external partners. Removing these accounts reduces the attacker's access to AI-assisted cyber operations, though similar groups may simply migrate to other AI platforms.
OpenAI shut down accounts linked to CyberAv3ngers, an Iran-connected group that was using AI to research industrial control systems and default credentials. The activity was detected and the accounts were terminated before any confirmed attacks occurred. The action reflects how AI platforms are now monitoring for state-sponsored cyber reconnaissance using their tools.
OpenAI suspended an account that used AI to generate a fake ChatGPT error message falsely claiming to detect Russian troll activity. The hoax message mimicked ChatGPT's interface to spread disinformation. The incident highlights how AI tools can be misused to create convincing false error messages and spread unverified claims.
OpenAI removed Russia-linked accounts running an operation called "Stop News" that used AI to generate multilingual disinformation targeting Ukraine and Western countries. The operation created articles and social media posts in multiple languages designed to spread influence. This action limits a specific state-sponsored disinformation campaign's ability to use OpenAI's AI systems for coordinated inauthentic behavior.
OpenAI removed accounts engaged in a coordinated inauthentic behavior campaign called "A2Z" that used AI to generate multilingual content promoting political narratives about elections, Ukraine, and political issues across social media platforms. The operation targeted multiple languages and coordinated across at least several platforms to spread influence content at scale. The removal disrupts this particular network's ability to use OpenAI's tools for coordinated inauthentic amplification of political messaging.
OpenAI banned a network of Iran-linked accounts operating under the codename STORM-2035 that used AI tools to generate election-related content targeting US and UK audiences across multiple websites.
OpenAI terminated accounts that an Israel-based startup used to generate spam conversations and distribute gambling site links on X using OpenAI's models. The network involved accounts accessing OpenAI's API to create automated posts promoting betting platforms at scale. The action prevents further abuse of OpenAI's infrastructure for coordinated gambling promotion across social media.
OpenAI removed accounts originating from Rwanda that were using AI tools to generate partisan political comments before the country's elections. The removals targeted coordinated inauthentic behavior using OpenAI's models to create election-related content at scale. The action prevents AI-generated disinformation campaigns from influencing voters during a sensitive political period.
OpenAI suspended accounts that were using its AI tools to generate abusive reports and complaints targeting Vietnamese public figures and online platforms. The company did not disclose the number of accounts removed or the scale of the campaign. This action reflects OpenAI's enforcement of policies against using AI systems for harassment and coordinated abuse.
OpenAI banned accounts that were using AI to generate comments criticizing a Russian anti-corruption foundation and related figures. The accounts were caught using the platform's models to create inauthentic critical content at scale. This represents enforcement of OpenAI's policy against coordinated inauthentic behavior and misuse of AI for disinformation campaigns.
Every AI story that matters,
in your inbox by 8am.
TLDRocket reads all relevant sources, removes duplicate coverage, and summarises the
day in two minutes. Follow companies and topics for alerts, or get the
briefing in Slack. Free, no spam, unsubscribe anytime.
Reading TLDRocket needs no cookies, and the readership counts we rely on come from
our own cookieless analytics. Google Analytics is the exception: it sets cookies and
reports to Google, so it stays switched off until you allow it. You can change your
mind any time from “Cookie settings” in the footer.
Strictly necessary
Session security and form protection (tldrocket-session,
XSRF-TOKEN, 2 hours). The site cannot work without them,
so they need no consent.
Always on
Google Analytics 4 (_ga,
_ga_<id>, up to 2 years). Measures which
stories and sections readers use. Google acts as a third-party processor and may
store the data outside the EU. No advertising, no profiling, no data sold.
