Foreign adversaries are using multiple AI tools, OpenAI warns

"A Russian-based actor that was generating content for a covert influence operation used ChatGPT to write prompts seemingly for another AI video model. A cluster of Chinese-language accounts used ChatGPT to research and refine phishing automation they wanted to run on China-based model DeepSeek. OpenAI also confirmed that an actor the company previously disrupted was the same one Anthropic recently flagged in a threat report, suggesting they were using both tools."

"Between the lines: OpenAI mostly observed threat actors using ChatGPT to improve their existing tactics, rather than creating new ones, Ben Nimmo, principal investigator on OpenAI's intelligence and investigations team, told reporters in a call ahead of the report's release. However, the multi-model approach means that investigators have "just a glimpse" at how threat actors are using a specific model, Nimmo said."

"In the latest report, OpenAI said it had banned accounts that appeared to be tied to both China-based entities and Russian-speaking criminal groups for using the model to help develop malware and write phishing emails. The company also banned accounts linked to Chinese government entities, including some that were asking OpenAI's models to "generate work proposals for large-scale systems designed to monitor social media conversations," according to the report."

OpenAI banned multiple accounts tied to nation-state campaigns that used ChatGPT alongside other AI models to enhance covert influence, phishing, and malware operations. A Russian-linked actor used ChatGPT to craft prompts for another AI video model. Chinese-language clusters used ChatGPT to research and refine phishing automation intended for China-based model DeepSeek. An actor previously disrupted by OpenAI was also flagged by Anthropic, suggesting cross-platform tool use. Investigators observed actors mostly improving existing tactics rather than inventing new ones and learning to conceal AI fingerprints, such as removing em dashes.

Read at Axios