OpenAI has banned accounts associated with a suspected China-based adversary, publicly tracked as SweetSpecter. This group emerged in 2023 and has reportedly focused on political entities in the Middle East, Africa, and Asia. Recently, SweetSpecter attempted to leverage OpenAI's models for offensive cyber operations, including spear-phishing attacks against OpenAI employees and global governments.

In May 2024, SweetSpecter sent spear-phishing emails to OpenAI employees, impersonating a ChatGPT user. These emails, blocked by OpenAI's security systems, contained malicious attachments designed to deploy Sugar Gh0st RAT malware, granting the attackers control over compromised machines. OpenAI's security team collaborated with industry partners, highlighting the importance of threat intelligence sharing.

During their investigation, OpenAI discovered SweetSpecter accounts using ChatGPT for vulnerability research and coding tasks. These activities align with LLM-themed tactics identified by Microsoft for the MITRE ATT&CK® Framework. While OpenAI utilized its models to analyze adversary activity, the group's use of AI did not appear to grant them novel capabilities beyond publicly available resources.