OpenAI announced the termination of five accounts linked to state‑affiliated threat actors after a joint investigation with Microsoft Threat Intelligence. The actors—Charcoal Typhoon and Salmon Typhoon (China), Crimson Sandstorm (Iran), Emerald Sleet (North Korea) and Forest Blizzard (Russia)—had used OpenAI services for open‑source research, translation, code debugging, script generation and content creation that could support phishing, malware evasion and intelligence gathering. OpenAI emphasizes that its models provide only limited, incremental advantages over existing non‑AI tools, yet the company is adopting a multi‑pronged safety strategy.

This includes continuous monitoring, collaboration across the AI ecosystem, iterative safety mitigations, and public transparency to inform stakeholders of misuse patterns. By sharing findings and disabling malicious accounts, OpenAI aims to reduce the risk posed by sophisticated state actors, protect the broader digital ecosystem, and maintain trust in AI applications that benefit everyday users. The disclosure underscores the growing importance of coordinated industry responses to AI‑enabled cyber threats and highlights the need for ongoing vigilance as adversaries explore emerging technologies.