Become a Member

Regulation TrackerLaws, orders and treaties read for their security duties and clocks Standards & FrameworksAttack taxonomies, control catalogues and frontier frameworks AI Incident DatabaseThe security incident record, with mechanism and lesson Research Paper LibraryThe papers that define the field, summarised OSS DirectoryRed teaming, guardrail, supply chain and evaluation tools Case StudiesProgrammes built, with measured outcomes AI Vulnerability TrackerCVEs and advisories for the components AI systems are built from

Latest in the tracker

New York Stop Addictive Feeds Exploitation (SAFE) for Kids Act and implementing rulesNew York's law restricting algorithmic feeds for minors takes effect on 25 January 2027 under final rules published in July 2026, with certified age assurance and $5,000-per-violation penalties.

Knowledge Base Regulation Tracker Standards & Frameworks OSS Directory AI Incident Database Research Paper Library Case Studies Society Articles News Jobs About Charter Become a Member

Home/AI Incident Database/OpenAI and Microsoft disclose that Chinese, Russian, Iranian and North Korean state actors used ChatGPT for cyber operations

OpenAI and Microsoft disclose that Chinese, Russian, Iranian and North Korean state actors used ChatGPT for cyber operations

The first public attribution of state cyber actors using a commercial LLM: five groups used ChatGPT to research targets, write phishing lures and debug malware, with capabilities the vendors described as incremental.

Severity: Mediumstate actorsopenaimicrosoftthreat report

At a glance

Organisation: OpenAI; Microsoft Threat Intelligence
Industry: AI developers and research labs
Country or region: Global
Occurred: 1 Jun 2023
Disclosed: 14 Feb 2024
Type of harm: Weaponisation for cyber operations, Social engineering and phishing, Malware and exploit generation

All details 15

Kind of system: Large language models
Severity: Medium
Confirmation: Confirmed by the organisation
Model: GPT-4 (ChatGPT)
Model provider: OpenAI
Technique: Reconnaissance, script debugging, phishing content and translation (AML.T0048)
Primary root cause: Insider or user misuse
Scale: Five state-affiliated groups (Charcoal Typhoon, Salmon Typhoon, Crimson Sandstorm, Emerald Sleet, Forest Blizzard)
Outcome: Accounts terminated; the first vendor disclosure of state-actor LLM use, followed by regular threat reports from OpenAI, Microsoft, Google and Anthropic.

Sources

Contribute

Spot an error, or know a record we should add? Members can propose additions and submit corrections.

Submit incident Report a correction or request removal

OpenAI and Microsoft disclose that Chinese, Russian, Iranian and North Korean state actors used ChatGPT for cyber operations

Sources

Contribute

Related in AI Incident Database

Reported Darknet Launch of Xanthorox AI Introduces Autonomous Cyberattack Platform