Chatgpt

Iran Used ChatGPT to Plant Fake Articles in US Publications

ATLAS OWASP HIGH ▲ 8.2 OpenAI (via HN) Oct 12, 2026

An Iranian influence operation leveraged ChatGPT to generate disinformation articles that were successfully planted inside legitimate U.S. news publications, according to an OpenAI disclosure. The campaign demonstrates how state-sponsored actors are operationalising large language models to scale credible-looking propaganda at reduced cost and effort. This represents a meaningful escalation in AI-assisted information warfare targeting Western media ecosystems.

AI Chatbots Poisoned via Web Seeding in Disinformation Campaign

ATLAS OWASP HIGH ▲ 8.2 Dark Reading Sep 24, 2026

Threat actors are actively manipulating AI chatbots including ChatGPT, Gemini, and Google AI Overviews by seeding the web with malicious links and optimised content designed to corrupt AI-generated answers. The campaign combines disinformation and phishing objectives, exploiting how large language models and retrieval-augmented systems ingest and surface web content. This represents a scalable, infrastructure-level attack on public trust in AI-assisted information retrieval.

Claude Used to Breach OpenAI Employee Account via Forum Flaw

ATLAS OWASP HIGH ▲ 8.2 Ars Technica Security Sep 19, 2026

Security researchers from Hacktron AI leveraged Anthropic's Claude to compromise an OpenAI employee's ChatGPT account through a vulnerability in OpenAI's Discourse-hosted community forum, gaining access to internal GitHub repositories. The attack chain — forum misconfiguration to internal SSO to privileged account — demonstrates how AI tooling can accelerate offensive security work against AI infrastructure. The incident also coincides with Anthropic disclosing that AI now leads 26% of its own R&D, raising broader concerns about recursive capability growth outpacing security controls.

Heap Overflow and SSO Flaw Let Hackers Access OpenAI Repos

ATLAS OWASP CRITICAL ▲ 8.5 OpenAI (via HN) Sep 18, 2026

Researchers from HacktronAI chained a heap buffer overflow in libheif (via ImageMagick on Discourse) with an OpenAI SSO misconfiguration to achieve RCE on community.openai.com, ultimately gaining access to employee ChatGPT and Codex accounts. With those compromised accounts, attackers could pivot to OpenAI's internal GitHub monorepo and connected services including Slack and email. The full exploit chain was discovered and disclosed responsibly within 72 hours, earning a $6,500 bug bounty.

ChatGPT Cross-Account Data Leakage via Sandbox Channel

ATLAS OWASP CRITICAL ▲ 9.2 Check Point Research Sep 09, 2026

Check Point Research uncovered a covert cross-account communication channel in ChatGPT's code-execution sandbox that allowed an attacker to hijack a victim's session and exfiltrate data from connected services such as Gmail. The attack exploited a shared internal package delivery service reachable by containers belonging to different user accounts, bypassing inter-container isolation. The channel could be triggered silently via malicious prompts, shared conversations, or custom GPTs without appearing in the victim's visible response.

ChatGPT Prompt Injection Exfiltrates Gmail Data via Hidden Channel

ATLAS OWASP HIGH ▲ 9.2 The Hacker News Sep 09, 2026

Check Point Research demonstrated a prompt injection attack against ChatGPT that allowed a hidden instruction to silently read a victim's connected Gmail data and exfiltrate it to an attacker-controlled account through an internal inter-container service. The attack exploited ChatGPT's agentic tool-use defaults, which permit reading connected apps without user confirmation under the 'Important actions' permission model. OpenAI has since taken the internal service used as the covert channel offline, but the underlying permission design and injection vectors remain a structural concern.

LLM-Assisted Intrusions Hit Latin American Orgs via NextChat

ATLAS OWASP HIGH ▲ 7.2 Palo Alto Unit 42 Sep 06, 2026

Unit 42 has identified two active intrusion campaigns targeting Latin American organisations in the transportation and financial sectors, with threat actors demonstrably leveraging commercial LLMs — including self-hosted NextChat instances — to orchestrate and refine attack execution. The campaigns share overlapping SOCKS5 relay infrastructure and exhibit iterative, AI-assisted scripting behaviour, suggesting independent but parallel adoption of LLM tooling by distinct threat groups. This represents a concrete operational example of adversaries using AI to lower the skill floor for multi-stage network intrusion and data exfiltration.

ChatGPT Abused by Cambodia Scam Network for Social Engineering

ATLAS OWASP HIGH ▲ 7.2 Schneier on Security Aug 27, 2026

OpenAI disrupted a Cambodia-based criminal network that weaponised ChatGPT to run multi-vector social engineering scams at scale, including romance fraud, fake investment schemes, gambling platform impersonation, and law enforcement extortion. The operation demonstrates how LLMs dramatically lower the barrier to producing convincing fraudulent personas, forged documents, and sustained deceptive conversations. This case illustrates a maturing threat model where commercial AI services are operationalised as force multipliers for organised cybercrime.

Claude and ChatGPT Hijacked via Zero-Click Prompt Injection

ATLAS OWASP CRITICAL ▲ 9.0 SecurityWeek Aug 07, 2026

Zenity researchers disclosed a zero-click attack chain capable of hijacking Claude and ChatGPT's agentic browser capabilities through malicious content embedded in emails and X posts. The vulnerabilities, reported to Anthropic and OpenAI in late 2025 and early 2026, remain unpatched as of publication. This represents a significant escalation in prompt injection risk, as no user interaction is required to trigger malicious AI agent behaviour.

ChatGPT Sandbox C2 Attack Demonstrated at Black Hat 2026

ATLAS OWASP HIGH ▲ 8.5 Dark Reading Aug 07, 2026

A researcher at Black Hat USA 2026 demonstrated a proof-of-concept attack chain enabling command-and-control-style influence over ChatGPT's isolated execution sandbox. The technique represents a significant escalation in LLM exploit sophistication, moving beyond prompt manipulation toward infrastructure-level session control. If reproducible at scale, this class of attack could undermine the isolation guarantees that underpin safe AI code execution environments.

AgentForger Flaw Lets Attackers Plant Invisible AI Agents in Orgs

ATLAS OWASP CRITICAL ▲ 9.0 SecurityWeek Jul 24, 2026

A newly patched vulnerability in OpenAI's ChatGPT agent infrastructure, dubbed AgentForger, allowed attackers to create, insert, and remotely control invisible autonomous AI agents inside victim organisations. The flaw represents a serious escalation in agentic AI risk, enabling adversaries to operate as a trusted AI insider without detection. OpenAI has issued a fix, but the technique highlights systemic risks in deploying autonomous AI agent frameworks within enterprise environments.

OpenAI Expands ChatGPT Into Family and Caregiver Households

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.2 TechCrunch AI Jul 12, 2026

OpenAI is building dedicated family-oriented product experiences for ChatGPT, targeting parents, caregivers, and older adults as adoption among users aged 35 and older accelerates. This household expansion introduces a high-value, trust-sensitive attack surface where vulnerable populations — including minors and elderly users — interact with AI systems that were not originally designed with their safety profiles in mind. Security teams and child-safety advocates should anticipate increased adversarial interest in manipulating family-mode guardrails, extracting parental oversight credentials, and exploiting the trust asymmetry between caregivers and AI-mediated household experiences.

OpenAI Workspace Phishing via Fraudulent Tenant Registration

ATLAS OWASP HIGH ▲ 7.2 BleepingComputer Jun 27, 2026

Threat actors are registering fraudulent OpenAI tenants impersonating legitimate companies and inviting employees to join them, in a campaign dubbed 'Poisoned Tenant' by Push Security. The attack exploits OpenAI's legitimate invitation infrastructure, making phishing emails appear authentic as they pass all email authentication checks. The goal appears to be tricking employees into submitting sensitive corporate information via ChatGPT chats and projects within the attacker-controlled workspace.

OpenAI's ChatGPT Image Generation Fails Content Moderation

FIRST LOOK ATLAS OWASP HIGH ▲ 8.2 OpenAI (via HN) Jun 22, 2026

Mindgard researchers demonstrated that ChatGPT's image generation pipeline can be manipulated through an indirect, socially-engineered prompt to produce violent and sexually explicit content without users directly requesting it, exposing a significant failure in OpenAI's content moderation controls. Defenders and enterprise operators of ChatGPT-integrated products face a newly validated attack class where innocuous-looking prompt patterns — potentially spreading virally — can systematically strip safety guardrails from image generation. This finding signals that content filter bypasses in multimodal systems are reproducible at scale, raising urgent questions about the adequacy of output-layer filtering as a sole defence mechanism.

OpenAI Ships GPT-5.5 Instant with Health Intelligence

FIRST LOOK ATLAS OWASP MEDIUM ▲ 5.8 OpenAI Blog Jun 21, 2026

OpenAI has upgraded ChatGPT's health and wellness response capabilities via GPT-5.5 Instant, incorporating stronger reasoning, physician-informed evaluations, and improved contextual understanding for medical queries. This expansion into high-stakes health guidance raises meaningful concerns for defenders, as improved fluency and authority in medical responses increases the risk of user overreliance and lowers the perceived threshold for trusting AI-generated health advice. Security and trust-safety teams should evaluate how this capability interacts with prompt injection, social engineering chains, and the broader risk of AI-mediated medical misinformation at scale.

Chatgpt

Stay ahead of the threat.