Research demo
AI Domination: remote controlling ChatGPT ZombAI instances through memory-persisted C2 instructions
AIR-2025-0002 AIR record · 2025-01-openai-chatgpt-zombai-c2
From the supporting source
An adversary can compromise ChatGPT instances and have them join a central Command and Control system which provides updated instructions for all the remote controlled ChatGPT instances to follow over-time.embracethered.com
The record
Disclosed
2025-01-06
Vendor
OpenAI
Product
ChatGPT
Risk domain
Reliability and observability › Data and memory poisoning
Also touches
Privilege escalation, Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted — the assistant executed C2 instructions persisted in memory
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document web
Impact type
C2 control, Data exfiltration, Persistent memory poisoning
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0020 – Poison Training Data
- NIST AI RMF
- MEASURE 3.1
- EU AI Act
- Article 15
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- D. Reliability
- Scope
- agent failure
- Mitigation
- Monitor model performance; Implement feedback diversity and circuit breakers.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
ChatGPT users whose memory was poisoned
Capability abused
Defense & remediation
Recorded defense
url_safe domain allowlist (GitHub and Azure Blob Storage remain reachable)
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
partial - the SpAIware exfiltration was fixed September 2024 for iOS/macOS; disclosed to OpenAI early October 2024
Taxonomy & references
Curator notes
Extends the 2024 SpAIware work into a persistent C2 channel.
Supporting sources
Cite as
Enkrypt AI. "AI Domination: remote controlling ChatGPT ZombAI instances through memory-persisted C2 instructions". AIR, AIR-2025-0002. https://agentincident.vercel.app/i/AIR-2025-0002/ (accessed 2026-10-19).