In the wild
Realized harm
SesameOp: backdoor abusing the OpenAI Assistants API as a covert command-and-control channel
AIR-2025-0165 AIR record · 2025-11-microsoft-sesameop
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
a component of the backdoor uses the OpenAI Assistants API as a storage or relay mechanism to fetch commands, which the malware then runs.microsoft.com
The record
Disclosed
2025-11-03
Occurred
2025-07-01
Vendor
OpenAI
Product
OpenAI Assistants API (abused as C2)
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Privilege escalation, Data exfiltration channels
System type
Generative model
Who acted
AI was the target (contested) — the Assistants API is abused as C2 transport, not attacked and not acting
Attack surface
Agent framework
Autonomy level
Fully autonomous
Initial vector
Compromised host web shells
Impact type
Espionage, Persistence, Data exfiltration, Command and control
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
one compromised enterprise environment (months of dwell time)
Capability abused
Defense & remediation
Recorded defense
network egress monitoring
Guardrail kinds
Human supervision, Permission scope
Guardrail outcome
Silent
Fix shipped
OpenAI disabled the abused account/API key; Microsoft published detections
Taxonomy & references
Curator notes
Microsoft DART. Borderline for an agent corpus: the AI service is abused as infrastructure rather than being the acting agent, but it is a real in-the-wild compromise turning on agent-API semantics. | Merged from duplicate id `2025-07-sesameop-openai-assistants-c2`. Also reported as: 'SesameOp: espionage backdoor using the OpenAI Assistants API as its command-and-control channel'.
Supporting sources
Cite as
Enkrypt AI. "SesameOp: backdoor abusing the OpenAI Assistants API as a covert command-and-control channel". AIR, AIR-2025-0165. https://agentincident.vercel.app/i/AIR-2025-0165/ (accessed 2026-10-19).