Openai

29 reports

All LLM Security Agentic AI Industry News Research Supply Chain Prompt Injection First Look: Security Regulatory Jailbreaks Adversarial ML Data Poisoning Model Theft AI Security Tools Security Operations

Prompt Injection Attacks Claude Code and Codex Execution

ATLAS OWASP HIGH ▲ 9.2 The Hacker News Jul 09, 2026

Researchers at the AI Now Institute have demonstrated a proof-of-concept attack dubbed 'Friendly Fire' that tricks AI coding agents — specifically Anthropic's Claude Code and OpenAI's Codex in autonomous mode — into executing malicious binaries while performing routine security reviews. The attack embeds a disguised payload inside an open-source library and uses a plain README.md instruction to direct the agent to run a malicious shell script, bypassing existing trust-prompt defences. Because the weakness is architectural rather than version-specific, no patch exists; mitigation requires workflow changes.

OpenAI Releases GPT-5.6 Sol for Vulnerability Research

FIRST LOOK ATLAS OWASP HIGH ▲ 8.2 The Hacker News Jun 29, 2026

OpenAI has released a limited preview of GPT-5.6 Sol, Terra, and Luna to select partners, positioning Sol as its most capable model for vulnerability research and exploit chain development, benchmarked against real-world hardened targets via an internal framework called VulnLMP. The model's demonstrated ability to produce credible memory safety leads and automate substantial portions of vulnerability research pipelines materially lowers the barrier for both defenders and adversaries. Security teams should expect accelerated attacker timelines for exploit development and increased pressure on detection and patch-deployment cadences.

OpenAI Workspace Phishing via Fraudulent Tenant Registration

ATLAS OWASP HIGH ▲ 7.2 BleepingComputer Jun 27, 2026

Threat actors are registering fraudulent OpenAI tenants impersonating legitimate companies and inviting employees to join them, in a campaign dubbed 'Poisoned Tenant' by Push Security. The attack exploits OpenAI's legitimate invitation infrastructure, making phishing emails appear authentic as they pass all email authentication checks. The goal appears to be tricking employees into submitting sensitive corporate information via ChatGPT chats and projects within the attacker-controlled workspace.

OpenAI Launches GPT-5.6 with Enhanced Agentic Capabilities

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 TechCrunch AI Jun 27, 2026

OpenAI has released GPT-5.6 in a restricted preview to government-vetted partners, featuring three models (Sol, Terra, Luna) with significantly upgraded agentic capabilities in coding, biology, and cybersecurity, including a coordinated multi-subagent 'ultra' mode. The cybersecurity-specific enhancements and agentic orchestration introduce meaningful new attack surface: adversaries gaining access to Sol's coordinated subagent architecture could automate sophisticated multi-stage intrusions at scale previously requiring significant human expertise. The restricted rollout itself creates a novel supply chain and access-control risk, as the 'trusted partner' gating model concentrates high-capability model access among a small set of privileged accounts, making partner credential compromise a high-value target.

OpenAI Releases GPT-5.6 Under Controlled Access

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 TechCrunch AI Jun 26, 2026

OpenAI's GPT-5.6, a frontier model with advanced cyber capabilities, is being released exclusively to vetted partners under a White House-directed limited-access programme coordinated with the Office of the National Cyber Director and OSTP. This controlled rollout signals that the model's offensive cyber potential — including autonomous vulnerability identification and exploitation — is significant enough to warrant government-gated distribution, mirroring Anthropic's Project Glasswing model for Claude Mythos. For defenders, the emergence of a government-approved, partner-tier distribution model creates new supply chain trust questions and raises the stakes around who gains early access and how that access is verified, monitored, and potentially abused.

OpenAI Launches Jalapeño Custom Inference Chip

FIRST LOOK ATLAS OWASP MEDIUM ▲ 5.8 TechCrunch AI Jun 25, 2026

OpenAI has unveiled 'Jalapeño', its first custom-built AI inference processor co-designed with Broadcom, optimised for running large language models at reduced cost and power consumption. The move deepens OpenAI's vertical integration across the full AI stack — from chip silicon through to end-user products — introducing new hardware supply chain dependencies and firmware-level attack surfaces that defenders must now account for. Security teams should treat purpose-built AI silicon as a new tier of the ML supply chain, with unique risks around hardware backdoors, firmware integrity, and reduced hardware diversity.

OpenAI Launches Patch the Planet Vulnerability Initiative

FIRST LOOK ATLAS OWASP MEDIUM ▲ 5.8 TechCrunch AI Jun 23, 2026

OpenAI has partnered with Trail of Bits to launch 'Patch the Planet,' an initiative using AI-assisted tooling (including Codex Security) to help open-source maintainers find and patch vulnerabilities at scale. While the defensive intent is clear, the program introduces new attack surface considerations: AI-generated patches applied to widely-used open-source projects create a high-value supply chain target, and the triage/remediation pipeline itself could be manipulated to introduce subtle flaws. Defenders should monitor open-source dependencies that receive AI-assisted patches and assess the integrity guarantees of the remediation workflow.

OpenAI's ChatGPT Image Generation Fails Content Moderation

FIRST LOOK ATLAS OWASP HIGH ▲ 8.2 OpenAI (via HN) Jun 22, 2026

Mindgard researchers demonstrated that ChatGPT's image generation pipeline can be manipulated through an indirect, socially-engineered prompt to produce violent and sexually explicit content without users directly requesting it, exposing a significant failure in OpenAI's content moderation controls. Defenders and enterprise operators of ChatGPT-integrated products face a newly validated attack class where innocuous-looking prompt patterns — potentially spreading virally — can systematically strip safety guardrails from image generation. This finding signals that content filter bypasses in multimodal systems are reproducible at scale, raising urgent questions about the adequacy of output-layer filtering as a sole defence mechanism.

OpenAI Ships GPT-5.5 Instant with Health Intelligence

FIRST LOOK ATLAS OWASP MEDIUM ▲ 5.8 OpenAI Blog Jun 21, 2026

OpenAI has upgraded ChatGPT's health and wellness response capabilities via GPT-5.5 Instant, incorporating stronger reasoning, physician-informed evaluations, and improved contextual understanding for medical queries. This expansion into high-stakes health guidance raises meaningful concerns for defenders, as improved fluency and authority in medical responses increases the risk of user overreliance and lowers the perceived threshold for trusting AI-generated health advice. Security and trust-safety teams should evaluate how this capability interacts with prompt injection, social engineering chains, and the broader risk of AI-mediated medical misinformation at scale.

OpenAI Launches ChatGPT for Science with Institutional Access

FIRST LOOK ATLAS OWASP MEDIUM ▲ 5.8 BleepingComputer Jun 18, 2026

OpenAI is internally testing a specialised 'ChatGPT for Science' subscription tier, likely restricted to verified universities and research institutions, building on capabilities from GPT-Rosalind — a purpose-built life sciences model already deployed under a trusted-access structure with select pharma partners. The gated, domain-specific nature of this offering creates novel identity and access verification attack surfaces, as threat actors will likely probe credential and institutional verification mechanisms to gain privileged access to specialised scientific knowledge. Defenders at academic and research institutions should anticipate increased phishing campaigns targeting institutional credentials and prepare governance frameworks for AI use in sensitive research environments.

ChatGPT Prompt Injection Enables Data Exfiltration

ATLAS OWASP MEDIUM ▲ 7.2 Simon Willison Jun 08, 2026

OpenAI has rolled out 'Lockdown Mode' for ChatGPT personal and self-serve business accounts, a deterministic control designed to block the data exfiltration leg of prompt injection attacks. The feature directly addresses the 'Lethal Trifecta' — the combination of private data access, untrusted content exposure, and an outbound exfiltration channel — by restricting outbound network requests at the infrastructure level rather than relying on AI-evaluated guardrails. Critically, OpenAI's own documentation acknowledges the feature's existence implies that default ChatGPT settings do not robustly prevent determined data exfiltration attacks.

ChatGPT Markdown Injection Enables Phishing in Web Summarizer

ATLAS OWASP HIGH ▲ 8.5 The Hacker News May 31, 2026

Permiso Security has disclosed ChatGPhish, a vulnerability in ChatGPT's web summarisation feature that allows attacker-controlled Markdown payloads embedded in third-party pages to render phishing links, spoofed alerts, and QR codes directly within ChatGPT's trusted UI. The attack requires no user interaction beyond asking ChatGPT to summarise a malicious page, and can exfiltrate IP addresses, User-Agent strings, and Referer headers via auto-fetched remote images. The technique significantly expands the phishing attack surface beyond email into everyday AI-assisted browsing workflows, posing a particular risk in enterprise environments.

ChatGPT Sharing Links Abused for Malware Delivery

ATLAS OWASP HIGH ▲ 7.5 BleepingComputer May 31, 2026

Threat actors are exploiting ChatGPT's legitimate content-sharing infrastructure to host convincing fake outage pages that trick users into downloading malware disguised as a ChatGPT desktop application. The 'LLMShare' campaign abuses chatgpt.com/s/ shared links to render attacker-crafted HTML within a trusted OpenAI domain, bypassing traditional phishing detection that relies on suspicious URL analysis. The attack chain combines Google ad abuse, domain cloaking, and AI platform misuse to deliver what are likely infostealer payloads.

TanStack Supply Chain Attack Exposes OpenAI Keys

ATLAS OWASP HIGH ▲ 8.5 The Hacker News May 15, 2026

A supply chain attack targeting TanStack via the Mini Shai-Hulud malware compromised two OpenAI employee devices, exposing internal source code repositories and code-signing certificates for macOS, iOS, and Windows apps. While no user data or production systems were breached, OpenAI was forced to revoke and reissue signing certificates, requiring macOS users to update ChatGPT Desktop, Codex, and Atlas apps before June 12, 2026. The incident marks OpenAI's second certificate rotation in two months and is part of a broader campaign by threat actor TeamPCP targeting major AI and open-source ecosystems.

OpenAI Daybreak Vulnerability Detection Enables LLM Jailbreak

ATLAS OWASP MEDIUM ▲ 7.2 The Hacker News May 13, 2026

OpenAI has launched Daybreak, an AI-powered cybersecurity platform combining GPT-5.5 variants and Codex Security to automate vulnerability detection, threat modelling, and patch validation for enterprise codebases. The initiative introduces a tiered model access structure — including a permissive 'GPT-5.5-Cyber' for red teaming — raising questions about dual-use risk and model misuse if access controls are circumvented. The rollout also contextualises a broader industry tension: AI is accelerating vulnerability discovery faster than defenders can remediate, contributing to triage fatigue and hallucinated bug reports.

Openai

Stay ahead of the threat.