OpenAI has banned ChatGPT accounts linked to threat actors publicly attributed to the People's Republic of China (PRC). These groups, identified as KEYHOLE PANDA (also known as APT5) and VIXEN PANDA (also known as APT15), used OpenAI's models for activities such as vulnerability research, scripting, translation, and operational troubleshooting. This action was detailed in a case study originally published in OpenAI's June 2025 report.
Separately, OpenAI also banned a ChatGPT account in February 2026 linked to an individual associated with Chinese law enforcement. This individual attempted to use the model to plan a covert influence operation targeting the Japanese prime minister and to edit status reports on "cyber special operations."
Key Points
- OpenAI banned ChatGPT accounts associated with KEYHOLE PANDA (APT5) and VIXEN PANDA (APT15).
- These threat actors used OpenAI models for vulnerability research, scripting, translation, and operational troubleshooting.
- Activities included modifying scripts, troubleshooting system configurations, and developing support activities like Linux system administration and software development.
- Examples of technical use included reNgine and Selenium automation.
- Threat actors also researched US federal defense industry, military networks, and government technology.
- OpenAI found no evidence that access to its models provided novel capabilities not otherwise publicly available.
- A separate ChatGPT account linked to Chinese law enforcement was banned for attempting to plan influence operations and edit status reports on "cyber special operations."
Context
According to OpenAI Safety, the threat actors engaged with models in both Chinese and English. Observed activity came from the same networks but fell into separate subsets based on their focus. One subset concentrated on open-source research and technical tasks like script modification and system troubleshooting. Another subset focused on developing support activities, including Linux system administration, software development (web, Android, C-language, Golang), and infrastructure setup (VPNs, Docker, local LLM deployments like DeepSeek).
OpenAI also noted that the individual linked to Chinese law enforcement used ChatGPT to edit and polish status reports on "cyber special operations" targeting domestic and foreign adversaries, including Chinese dissidents and critics of the Chinese Communist Party (CCP). This effort appears to be large-scale, involving hundreds of staff, thousands of fake accounts, and locally deployed AI models.
Why It Matters
These actions highlight the ongoing efforts by AI developers to identify and mitigate malicious uses of their platforms by state-affiliated actors. The incidents demonstrate how threat groups and state actors attempt to leverage AI models for various cyber activities, from technical development to influence operations, underscoring the need for robust safety and security measures.
What To Do
- Note the types of activities, such as vulnerability research and scripting, that threat actors attempted to perform with AI models.
- Review the examples of technical engagement, including the use of reNgine and Selenium automation, for potential indicators of compromise.
- Observe the reported methods of influence operations, such as planning covert campaigns and editing status reports, to understand evolving tactics.
- Consider the LLM ATT&CK framework as a reference for mapping observed AI-assisted malicious activities.