OpenAI took action against STORM-0817, an Iran-linked threat group, by banning accounts that were using its AI models to debug Android malware, scrape data from social media platforms, and translate hacking tools. The accounts were detected and removed from the platform as part of OpenAI's effort to prevent malicious use of its services. This enforcement demonstrates OpenAI's ongoing efforts to identify and block state-linked actors attempting to abuse generative AI for cybercriminal and espionage activities.
OpenAI terminated accounts linked to SweetSpecter, a suspected China-based cyber group, which had been using the platform's AI to research security vulnerabilities, generate malicious code, and craft spear-phishing messages. The group's activities were detected and documented by OpenAI's threat intelligence team working with external partners. Removing these accounts reduces the attacker's access to AI-assisted cyber operations, though similar groups may simply migrate to other AI platforms.
OpenAI shut down accounts linked to CyberAv3ngers, an Iran-connected group that was using AI to research industrial control systems and default credentials. The activity was detected and the accounts were terminated before any confirmed attacks occurred. The action reflects how AI platforms are now monitoring for state-sponsored cyber reconnaissance using their tools.
Every AI story that matters,
in your inbox by 8am.
TLDRocket reads all relevant sources, removes duplicate coverage, and summarises the
day in two minutes. Follow companies and topics for alerts, or get the
briefing in Slack. Free, no spam, unsubscribe anytime.
Reading TLDRocket needs no cookies, and the readership counts we rely on come from
our own cookieless analytics. Google Analytics is the exception: it sets cookies and
reports to Google, so it stays switched off until you allow it. You can change your
mind any time from “Cookie settings” in the footer.
Strictly necessary
Session security and form protection (tldrocket-session,
XSRF-TOKEN, 2 hours). The site cannot work without them,
so they need no consent.
Always on
Google Analytics 4 (_ga,
_ga_<id>, up to 2 years). Measures which
stories and sections readers use. Google acts as a third-party processor and may
store the data outside the EU. No advertising, no profiling, no data sold.
