Charcoal Typhoon used ChatGPT for research, scripting and phishing content

Confirmed

OpenAI and Microsoft both state the accounts were tied to this actor; activity was limited, non-novel assistance.

The China-affiliated group used ChatGPT to research companies and security tools, debug code and generate scripts, and write likely phishing content.

“Charcoal Typhoon used our services to research various companies and cybersecurity tools, debug code and generate scripts, and create content likely for use in phishing campaigns.”OpenAI

Sources

Disrupting malicious uses of AI by state-affiliated threat actorsOpenAI · 14 Feb 2024 · primary source
Staying ahead of threat actors in the age of AIMicrosoft Security Blog · 14 Feb 2024 · primary source

Date: Feb 2024
Disclosed: 14 Feb 2024
Actor: Charcoal Typhoon (nation state), as attributed by OpenAI
Nexus: China
Targets: Government and defense-related targets (per source)
What the AI did: Recon, Malware dev, Phishing content
Model: ChatGPT (OpenAI services)
Model family: OpenAI
Model basis: stated by vendor
Autonomy: assist
Outcome: OpenAI accounts disabled in coordination with Microsoft.