In the wild
Realized harm
ScopeCreep: Russian-speaking actor iteratively built a Go Windows stealer with ChatGPT, delivered via a fake game tool
AIR-2025-0038 AIR record · 2025-06-openai-scopecreep
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
The actor distributed the ScopeCreep malware through a publicly available code repository that impersonated a legitimate and popular crosshair overlay tool (Crosshair-X) for video games.cdn.openai.com
The record
Disclosed
2025-06-05
Occurred
2025
Vendor
OpenAI
Product
ChatGPT
Risk domain
Access control and permissions › Credential theft
System type
Generative model
Who acted
Human acted on output — ChatGPT wrote the stealer; the actor delivered it via a fake game tool
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Direct misuse for malware development
Impact type
Malware distribution, Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Distributed via a repository impersonating the Crosshair-X gaming overlay; samples reached VirusTotal but OpenAI saw no evidence of widespread distribution
Capability abused
Defense & remediation
Recorded defense
Model refusals
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Accounts banned; malicious repository taken down with industry partners
Taxonomy & references
Curator notes
OpenAI is candid that the capabilities were 'not particularly novel' and that impact was likely mitigated by fast takedown - so real but small. The operator's opsec (temporary emails, one incremental code change per account, then abandon) is the durable lesson for detection.
Supporting sources
Cite as
Enkrypt AI. "ScopeCreep: Russian-speaking actor iteratively built a Go Windows stealer with ChatGPT, delivered via a fake game tool". AIR, AIR-2025-0038. https://agentincident.vercel.app/i/AIR-2025-0038/ (accessed 2026-10-19).