In the wild
Realized harm
Microsoft and OpenAI disclosed state-sponsored groups from North Korea, Iran, Russia and China using LLMs for target research and spear-phishing
AIR-2024-0009 AIR record · 2024-02-microsoft-openai-state-actor-llm-abuse
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
Microsoft said it detected and disrupted, in collaboration with business partner OpenAI, many threats that used or attempted to exploit AI technology they had developed.theguardian.com
The record
Disclosed
2024-02-14
Occurred
2024-02-14
Vendor
OpenAI / Microsoft
Product
OpenAI models via API and ChatGPT
Risk domain
Privacy › Sensitive data exposure
System type
Generative model
Who acted
Human acted on output — state actors used LLM output for research and phishing they sent themselves
Attack surface
Other
Autonomy level
Assistant
Initial vector
Policy violating use
Impact type
Ecosystem abuse, Information disclosure
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0057 – LLM Data Leakage
- NIST AI RMF
- MEASURE 2.10
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Use data anonymization; Implement log sanitization to scrub PII.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
global defence, cybersecurity and cryptocurrency targets; five named state-linked groups including Kimsuky (Emerald Sleet) and Forest Blizzard
Capability abused
Defense & remediation
Recorded defense
usage policy enforcement and threat-actor monitoring
Guardrail kinds
Human supervision, Abuse detection
Guardrail outcome
Silent
Fix shipped
accounts terminated; joint Microsoft/OpenAI threat-intel programme established
Taxonomy & references
Curator notes
The first joint vendor threat-intelligence disclosure of nation-state LLM abuse, and the template every later OpenAI/Anthropic misuse report follows. Use was productivity-augmenting (research, translation, phishing text), not yet autonomous — the baseline that later Cursor- and Claude-assisted intrusion records should be read against. AI Incident Database incident 644.
Supporting sources
Cite as
Enkrypt AI. "Microsoft and OpenAI disclosed state-sponsored groups from North Korea, Iran, Russia and China using LLMs for target research and spear-phishing". AIR, AIR-2024-0009. https://agentincident.vercel.app/i/AIR-2024-0009/ (accessed 2026-10-19).