Hackers Hijack OpenAI API: When Your Chatbot Becomes a Cybercriminal’s Uber
Hackers are using OpenAI’s Assistants API not to wax poetic but as a secret channel for malware control. Dubbed “SesameOp,” this ingenious campaign blends in with normal AI traffic, avoiding detection. Microsoft notes it exploits OpenAI’s capabilities, turning a cloud tool into a cybercriminal’s getaway car.
Hot Take:
Who knew that OpenAI’s Assistants API could moonlight as a secret agent? While most of us are busy asking it to draft our emails or compose haikus, some folks have found a more diabolical use for it. Next time you think your chatbot is just being cheeky, maybe it’s actually plotting world domination!
Key Points:
- Hackers are using OpenAI’s Assistants API as a command-and-control channel for malware.
- A backdoor dubbed “SesameOp” cleverly disguises its traffic as legitimate AI activity.
- Microsoft’s Incident Response team highlighted the sophisticated techniques used by the malware.
- The Assistants API is scheduled for deprecation in 2026, but the trend of abusing cloud tools continues.
- OpenAI has disabled an API key and account suspected to be used by attackers.
Already a member? Log in here