In the wild
Realized harm
OpenAI banned Russian-speaking criminal accounts building RAT, stealer and crypter components with ChatGPT
AIR-2025-0143 AIR record · 2025-10-openai-russian-malware-tooling
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
We banned ChatGPT accounts that were attempting to use the model to help develop and refine malware, including a remote‑access trojan, credential stealers, and features to evade detection.cdn.openai.com
The record
Disclosed
2025-10-07
Occurred
2025
Vendor
OpenAI
Product
ChatGPT
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft, Policy drift
System type
Generative model
Who acted
Human acted on output — ChatGPT wrote malware components that humans compiled and used
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Direct misuse for malware component development
Impact type
Malware development, Credential theft tooling
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Multiple accounts tied to a Telegram-advertised criminal group; tooling for in-memory loaders, UAC/SmartScreen/MOTW bypasses, browser cookie decryption, wallet parsing and clipboard hijacking
Capability abused
Defense & remediation
Recorded defense
Model refusals for overtly malicious requests
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Accounts banned (Oct 2025)
Taxonomy & references
Curator notes
Non-agentic in the strict sense - OpenAI states 'Our models were not used to execute any threat actor tooling and workflows' - but included because the outputs were assembled into deployed malware. The tradecraft of interest is decomposition: the actor elicited individually innocuous building blocks after direct requests were refused, and rotated one conversation per account to evade behavioural detection.
Supporting sources
Cite as
Enkrypt AI. "OpenAI banned Russian-speaking criminal accounts building RAT, stealer and crypter components with ChatGPT". AIR, AIR-2025-0143. https://agentincident.vercel.app/i/AIR-2025-0143/ (accessed 2026-10-19).