Cases › produced harmful content › LR-2026-0426
OpenAI reports Chinese state-linked operators used ChatGPT to plan influence and cyber campaigns
Preliminary Why: 1 report: Cyber Security News · subject to change · 1 independent report
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: no action reported
No source states: loss or records, agent tool, could do, deployer, industry.
Severity major: test: many third parties, a stated count of two or more affected parties. The source states the operations spanned over 300 foreign social media platforms.
A ChatGPT account linked to an individual associated with Chinese law enforcement was used to plan and document covert cyberattack and influence campaigns, according to OpenAI’s February 2026 threat disruption report. In mid-October 2025 the user asked the model to help design a campaign targeting a Japanese politician, and the model refused. Despite that refusal, the operation went ahead, and the same user returned days later to polish a status report on its real-world implementation. OpenAI’s team confirmed the campaign’s footprint across several platforms. The operations reportedly spanned over 300 foreign social media platforms and involved thousands of fake accounts. The ChatGPT account was primarily used to edit and polish periodic status updates, while the operators used locally deployed models for monitoring and content creation.
What happened
What was done
No source states an action or fix.
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Read from the sources; not yet reviewed by a person.
Controls
ModelEffective Safety training and refusal
Control failure chain
L1 · ModelOpenAIModel provider
Model version not linked to a model card.
Other controls for this risk at this layer, not mentioned in the sources: Cyber and weapons safeguards, Abuse monitoring and account enforcement, Staged or restricted release, Dangerous-capability testing before release, Outside red-teaming, Content safety classifiers, Safeguards kept on in testing, Reasoning monitoring.
L2 · HarnessHarness not namedAgent framework vendor
No source mentions a control at this layer.
L3 · ApplicationThe attackerDeployer
The attacker ran the agent; this layer was the attacker's own.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Known flaws patched, Multi-factor sign-in and password policy, Network segmentation, Intrusion and endpoint detection, Backups and recovery, Phishing and fraud filters.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Safety training and refusal | L1 Model | Effective |
| Content safety classifiers | L1 Model | Not stated in sources |
| Cyber and weapons safeguards | L1 Model | Not stated in sources |
| Dangerous-capability testing before release | L1 Model | Not stated in sources |
| Outside red-teaming | L1 Model | Not stated in sources |
| Staged or restricted release | L1 Model | Not stated in sources |
| Abuse monitoring and account enforcement | L1 Model | Not stated in sources |
| Reasoning monitoring | L1 Model | Not stated in sources |
| Safeguards kept on in testing | L1 Model | Not stated in sources |
| Known flaws patched | L4 Infrastructure / target | Not stated in sources |
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Not stated in sources |
| Network segmentation | L4 Infrastructure / target | Not stated in sources |
| Intrusion and endpoint detection | L4 Infrastructure / target | Not stated in sources |
| Backups and recovery | L4 Infrastructure / target | Not stated in sources |
| Phishing and fraud filters | L4 Infrastructure / target | Not stated in sources |
Similar incidents
Evidence
No source states: what it reached or did, how it was caught, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 3 items from the primary sources
What happened, in order
- 2024-05 OpenAI had first exposed the doxxing website revealscum.com as part of the Spamouflage network.
- 2025-10 The ChatGPT user asked the model to help design a covert influence campaign targeting a Japanese politician; the model refused.
- 2026-02 OpenAI published the findings in its February 2026 threat disruption report.
Show every field, with its source and grade
The AI system
What happened
Impact
LR-2026-0426 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON