vendors/openai.htmlSecurity news, advisories and CVEs for OpenAIMon, 19 Oct 2026 12:28:44 GMT https://thehackernews.com/2026/10/opencode-console-breach-may-have.htmlynfx3xMon, 19 Oct 2026 06:07:08 GMTThe Hacker News. An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its…Breach https://news.google.com/rss/articles/CBMib0FVX3lxTE8tX2JsNkJVOWtWMEhnWXRtemNmWkpqeGdwRkJJdVJia0I0djZSS1JTRDBDa3FTZXBILWlPd0J0c0VnU1BJbjdwZWRaN2JCaXdjdDMzbTg4TUdpbEFKTk5aYmxOQ2ZWQ1psZ081TGhHb9IBdEFVX3lxTE1xMm5uMFh4SGFxaGNhcEpaNjE5Tm1Wc0xkb1ZYd0hPVGN1d3RzYWJ5M2dTUVZUTzhQTWJ3czRWTzY2SzhjcE9ZVmlQZWlFTHNvTjFXajRvM1E2alN3aktNdGRHNU5EX2ZPMzhnckl1R01FLUxX?oc=5ws6bqlSat, 17 Oct 2026 05:34:30 GMTCybersecurity News. OpenAI Confirms Its AI Model Hacked Government Website While Counting Hospital Beds CyberSecurityNewsAI https://cybersecuritynews.com/openai-confirms-ai-model-hacked/1jul4ajSat, 17 Oct 2026 04:15:46 GMTCybersecurity News. OpenAI has confirmed that an internal AI model hacked an unnamed government statistics website while trying to count hospital beds. The June 17, 2026 incident started as a data task during reinforcement-learning training, but turned into unauthorized access…AI https://arstechnica.com/security/2026/10/openai-models-hacked-a-crypto-wallet-and-breached-more-websites/6ftyy2Fri, 16 Oct 2026 20:59:01 GMTArs Technica. The actions could have resulted in criminal charges had humans been behind the keyboard.Breach https://www.darkreading.com/application-security/fake-claude-chatgpt-attacks-developers-risknljallFri, 16 Oct 2026 19:49:30 GMTDark Reading. Campaigns that impersonate popular AI brands are on the rise, and they typically use ClickFix-like tactics to target unsuspecting enterprise employees.AI https://thehackernews.com/2026/10/openai-research-model-spent-3rd-party.html12hpvptFri, 16 Oct 2026 14:03:04 GMTThe Hacker News. OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ethereum test network, spent test cryptocurrency from a… https://www.malwarebytes.com/blog/ai/2026/10/openai-sued-over-children-safety-and-data-use6x0mhrFri, 16 Oct 2026 10:51:20 GMTMalwarebytes Labs. Eight US states and a mother of two accuse the ChatGPT maker of putting children’s safety and privacy at risk.Research https://www.securityweek.com/openai-models-hacked-data-portals-raided-a-crypto-wallet-to-finish-tasks/wajiidFri, 16 Oct 2026 10:32:11 GMTSecurityWeek. Left without funds for a coding task, an OpenAI model spent test crypto from a stranger’s wallet and left it out of its report. https://cybersecuritynews.com/new-aoki-malware/13qi31eFri, 16 Oct 2026 10:22:47 GMTCybersecurity News. Aoki, also known as Aokigahara, is a data-stealing malware that has added credentials for AI tools to its growing list of targets. Recent versions seek local files and session data linked to ChatGPT, Claude, OpenAI Codex, Cursor, Codeium and Gemini. The…MalwareAI https://cybersecuritynews.com/chatgpt-github-connector-flaw/u1tid3Thu, 15 Oct 2026 15:47:08 GMTCybersecurity News. A critical flaw in ChatGPT’s GitHub integration has the potential to turn a routine repository review into a secret-theft attack. A report published on October 15, 2026, describes a scenario in which manipulated repository instructions allegedly lead an AI…VulnerabilitySupply chainAI https://www.404media.co/chatgpt-ads-target-your-phone-number-email/nfycl2Thu, 15 Oct 2026 14:31:09 GMT404 Media. OpenAI's ads targeting is pretty creepy, and new research confirms spyware companies are delivering potent malware through advertising networks.AI https://cybersecuritynews.com/west-african-scam-networks/znmp62Wed, 14 Oct 2026 13:44:57 GMTCybersecurity News. Meta, Google, Microsoft and OpenAI joined an international crackdown on West African scam networks that removed more than 3.7 million Facebook and Instagram accounts, pages and groups. Announced on October 13, 2026, the operation led to 28 arrests and the… https://securityaffairs.com/200933/cyber-crime/hidden-audio-recorder-found-at-openai-as-employee-faces-federal-charges.html1rz0d0uWed, 14 Oct 2026 11:37:42 GMTSecurity Affairs. OpenAI employee charged with planting hidden audio recorders to capture sensitive discussions about AI research and company strategy. On September 30, OpenAI staff found a small audio recording device jammed into a USB port on the back of a television in an… https://thehackernews.com/2026/10/researchers-used-public-openai-model-to.html1839j7lWed, 14 Oct 2026 11:19:02 GMTThe Hacker News. A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. Its researchers built the attack in six days by directing AI agents…Vulnerability https://news.google.com/rss/articles/CBMibkFVX3lxTFBNMjNEcHl5aDBYQ2tFTWlKNE1pREludGJiN2dSSFdTaTVfakJ2ckxpc0p3TUVhSDY5TU1oTVJXN1V4eWxEMlRGcEkxa29LUDU3RnljU1NTT1hmem43ZXRQYjEwaTJod0dYSDNZOGZ30gFzQVVfeXFMTXk1WUhMMUJnZG8wY1I1b24wY0tKeWlILWxxNkNJclNSQzdZdEZJMDlwRnZ2d2gySjJnWE5NaWc0b1FiNWIwWUZ5OGs2eC1sMWpBdThtN1NyczR6LVUyQ0l2bzJzWm1LMk96dmlVdEYzdDV2cw?oc=5175gfdlWed, 14 Oct 2026 10:47:02 GMTCybersecurity News. VirusTotal Integrates Threat Intelligence With ChatGPT for Malware Analysis CyberSecurityNewsMalwareAI https://cybersecuritynews.com/virustotal-chatgpt-integration/1063d0dWed, 14 Oct 2026 10:45:17 GMTCybersecurity News. VirusTotal can now bring threat intelligence into ChatGPT through VirusTotal AI (VTAI), allowing users to investigate suspicious files, URLs, domains, and IP addresses within a conversation. The connection helps analysts retrieve existing reports and explain…MalwareAI https://www.theregister.com/security/2026/10/14/openai-engineer-charged-after-boardroom-bug-found-wrapped-in-toilet-paper/530300010dlpfsWed, 14 Oct 2026 09:55:00 GMTThe Register. FBI alleges covert recorder was plugged into a TV, with a second device later discovered in the employee's bagVulnerabilityLaw & policy https://www.helpnetsecurity.com/2026/10/14/openai-engineer-arrested-hidden-recording-device/1vdg15lWed, 14 Oct 2026 08:40:41 GMTHelp Net Security. A recording device wrapped in toilet paper and plugged into the back of a television in an executive conference room at OpenAI’s San Francisco office has led to the arrest of one of the company’s engineers. Abdulrahman Alfozan, a 35-year-old Saudi national…Law & policy https://news.google.com/rss/articles/CBMiggFBVV95cUxQZlh4akY4dXJzU3k5Y2J0LTE2YWJnbVpVOWxsbXl2YldaLXprMUtPRWRGRDVUZmhaUWItc2FBQ3ptQ1kzU3g4UXF4elhtUEZfWnd1Y0sxcGNkZVpsWENIZnNsSnFESkRTb3JNbmtWeEt3MnNPWExOdm44WGVuYnVNTEpR0gGHAUFVX3lxTE1HRjFNd2FGR1BVN1pfQ2NUaExRWVNCVXBYdkdLaDkyLTRvZHFGVGlOdTY4bmQ4dzNkdm9rTFJJbGF6RF9qTFdIaXpHcDUxVk1NRmg2WmNEVkhBQmFtSEJ3MWdVcXVJemFEQjdLTTZGNllMZWk5ZXhaZ1BTY3o0SkFmWEFMMDdCWQ?oc=51bazybvWed, 14 Oct 2026 05:32:56 GMTCybersecurity News. OpenAI Engineer Arrested for Planting Spyware Device in an Executive Conference Room CyberSecurityNewsMalwareLaw & policy https://cybersecuritynews.com/openai-engineer-arrested-for-planting-spyware/1wcyor2Wed, 14 Oct 2026 02:25:18 GMTCybersecurity News. An OpenAI engineer has been arrested for allegedly hiding an audio recording device in an executive conference room at the company’s San Francisco offices. Abdulrahman Alfozan, 35, a Saudi national, was arrested on October 9, 2026, and appeared in federal…MalwareLaw & policy https://thehackernews.com/2026/10/openai-employee-arrested-for-allegedly.htmlgl9575Wed, 14 Oct 2026 01:59:25 GMTThe Hacker News. A Saudi national and employee of OpenAI has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to covertly record sensitive conversations. Abdulrahman Alfozan, 35, has been…Law & policy https://www.securityweek.com/employee-arrested-after-listening-device-found-in-openai-conference-room-fbi-and-the-company-say/1mc55rjTue, 13 Oct 2026 23:07:00 GMTSecurityWeek. Saudi national Abdulrahman Alfozan was arrested Friday and terminated by OpenAI.Law & policy https://therecord.media/saudi-national-charged-with-spy-device-openai1jzy9rqTue, 13 Oct 2026 23:00:00 GMTThe Record. Abdulrahman Alfozan, 35, a Saudi national working as an engineer for OpenAI, was charged Tuesday with secretly bugging an executive conference room at one of the company’s buildings in San Francisco.Law & policy https://www.bleepingcomputer.com/news/artificial-intelligence/openai-engineer-arrested-for-allegedly-planting-spy-device-in-office/61eu13Tue, 13 Oct 2026 22:33:02 GMTBleepingComputer. A Saudi OpenAI engineer has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to secretly record sensitive conversations. [...]Law & policy https://techcrunch.com/2026/10/13/fbi-arrests-openai-employee-accused-of-planting-hidden-recording-device-in-conference-room/1b2pflsTue, 13 Oct 2026 20:59:11 GMTTechCrunch Security. It's not clear exactly for what purpose the recording device was used, but FBI director Kash Patel said the scheme was to "capture sensitive communications about the company’s super intelligence technology."Law & policy https://www.securityweek.com/openai-fires-3-safety-researchers-in-dispute-over-ai-risks/1kzadgkFri, 09 Oct 2026 21:07:46 GMTSecurityWeek. The ChatGPT maker said the researchers "violated clear policies on handling sensitive information.”AI https://therecord.media/openai-disrupts-russian-iranian-operations-chatgpt12ouhhlFri, 09 Oct 2026 13:50:00 GMTThe Record. A Latin American propaganda operation run by Russians and a cluster of Iranian fake journalist identities each had help from now-closed ChatGPT accounts, OpenAI's safety team said.AI https://cyberscoop.com/openai-disrupts-russia-iran-ai-influence-operations/war910Thu, 08 Oct 2026 17:44:43 GMTCyberScoop. The two campaigns were rated 4 and 5 out of 6 for severity, the first time OpenAI has reported what it considers a high-impact influence campaigns.AI https://www.darkreading.com/cyberattacks-data-breaches/openai-agent-escape-causes-wikimedia-service-outage1ftr98xWed, 07 Oct 2026 19:34:08 GMTDark Reading. Autonomous agents also tried to abuse other websites and services hosted by the foundation, using them as proxies for unauthorized activities. https://securityaffairs.com/200506/ai/wikimedia-finds-unauthorized-openai-agent-activity-on-wikipedia.html1elbmo2Wed, 07 Oct 2026 07:50:21 GMTSecurity Affairs. Wikimedia found unauthorized OpenAI agent activity on its platforms, including unapproved edits, proxy attempts and millions of automated API requests. Wikimedia ran its own investigation after other organizations started reporting rogue AI agents breaking… https://thehackernews.com/2026/10/fake-chatgpt-gemini-and-claude-ad.html1g513f3Tue, 06 Oct 2026 18:38:55 GMTThe Hacker News. Cybersecurity researchers have disclosed details of a "human-operated phishing platform" that impersonates advertising products for artificial intelligence (AI) chatbots like Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus.…AI https://www.bleepingcomputer.com/news/security/fake-chatgpt-gemini-sites-steal-advertising-accounts-mfa-codes/uecjfTue, 06 Oct 2026 15:16:44 GMTBleepingComputer. A new campaign targeting ad account managers uses fake ChatGPT, Gemini, Claude, and Perplexity sites that steal login credentials and multi-factor authentication (MFA) codes through browser-in-browser attacks. [...]AI https://www.helpnetsecurity.com/2026/10/06/openai-rogue-agents-wikimedia-wikipedia/1r9fowaTue, 06 Oct 2026 13:49:28 GMTHelp Net Security. Rogue OpenAI agents made unauthorized edits on Wikimedia wikis and sent millions of automated requests to Wikimedia’s public APIs, traffic that may have contributed to a partial outage of the Wikidata Query Service in May, the Wikimedia Foundation said on… https://arstechnica.com/security/2026/10/openai-agents-tried-to-hack-wikipedia-tools-and-flooded-it-with-traffic/1njvtr9Tue, 06 Oct 2026 12:21:53 GMTArs Technica. The reports of OpenAI agents harming third-party sites keep coming. https://thehackernews.com/2026/10/wikimedia-says-openai-agents-tried-to.htmldpx67lTue, 06 Oct 2026 11:26:25 GMTThe Hacker News (+1 more sources). The Wikimedia Foundation, which hosts Wikipedia, has confirmed that it has discovered activity by rogue OpenAI agents on its platforms, including unsuccessful efforts to compromise Etherpad, a public note-taking tool, and edit Wikipedia pages. "The… https://therecord.media/wikimedia-foundation-openai-agents-reporty2u0fdMon, 05 Oct 2026 21:26:00 GMTThe Record. Beyond the potential misuses of its services, Wikimedia said activity by AI agents can be a drain on web platforms that are already operating with limited resources. https://securityaffairs.com/200372/security/another-openai-safety-expert-quits-and-raises-new-ai-safety-concerns.html1y955skMon, 05 Oct 2026 07:30:04 GMTSecurity Affairs. OpenAI safety veteran David Robinson resigns, warning that the company’s culture and fast AI development model could create bigger risks. OpenAI safety veteran David Robinson knows how his resignation looks. He starts his essay by calling himself “something…AI https://techcrunch.com/2026/10/03/openai-safety-employee-resigns-claiming-the-companys-culture-is-broken/y4ff5dSat, 03 Oct 2026 16:30:01 GMTTechCrunch Security. By his own admission, David Robinson is “something of a cliché”: an employee at a leading AI company who issues a dire warning while resigning from their job. https://databreaches.net/2026/10/03/openai-faces-california-doj-subpoena-amid-growing-cybersecurity-incident-notices/ck2dhcSat, 03 Oct 2026 13:41:12 GMTDataBreaches.net. IAPP reports: Regulator inquiries into major AI companies’ cybersecurity practices are ramping up. A day after reports surfaced about the likely escalation of a U.S. Federal Trade Commission probe into OpenAI and other developers, California Attorney General…BreachLaw & policy https://www.theregister.com/security/2026/10/02/openai-alerts-100-orgs-that-its-misaligned-models-attempted-to-break-in-or-worse/53008911ajpmgbFri, 02 Oct 2026 17:37:05 GMTThe Register. Mostly 'routine research tasks,' and 'some involved government websites, which our models often use,' AI giant tells The Reg https://www.theregister.com/ai-and-ml/2026/10/02/openais-wandering-ai-agents-earn-it-a-california-subpoena/53008501cayyzhFri, 02 Oct 2026 14:34:00 GMTThe Register. Plus: Attorneys-general say investigators should have direct access to AI companies' records when things go wrongAI https://thehackernews.com/2026/10/openai-parts-ways-with-three-safety.htmlnrefsaFri, 02 Oct 2026 12:23:15 GMTThe Hacker News. OpenAI has parted ways with three members of its safety team after they leaked private information in violation of company policies, The Wall Street Journal reported. "We have parted ways with three individuals for violating our policies on accessing and… https://therecord.media/openai-software-attempted-to-secretly-scrape-data-from-dozens-of-websitesbns8qrThu, 01 Oct 2026 19:25:00 GMTThe Record. The findings, released Thursday by Asymmetric Security, are just the latest example of rogue behavior spurred by OpenAI’s software. https://techcrunch.com/2026/10/01/openai-cuts-ties-with-three-safety-researchers-wsj-reports/1rpz7ybThu, 01 Oct 2026 18:14:42 GMTTechCrunch Security. OpenAI has parted ways with three safety researchers after an internal investigation found they mishandled sensitive company information, report says. https://thehackernews.com/2026/10/openai-disrupts-reasoning-extraction.html91e5bnThu, 01 Oct 2026 10:42:36 GMTThe Hacker News. OpenAI on Wednesday said it identified and disrupted a coordinated distillation campaign that was designed to illicitly extract protected reasoning from its artificial intelligence (AI) models. A "core cluster of the activity," going back to the first week of…AI https://www.securityweek.com/ftc-is-investigating-openai-and-anthropic-over-possible-risks-to-consumers/k4quoeWed, 30 Sep 2026 23:43:51 GMTSecurityWeek. An FTC spokesperson confirmed the investigation but declined further comment. https://cyberscoop.com/openai-moonshot-ai-model-distillation-attack/jlkhrxWed, 30 Sep 2026 22:17:34 GMTCyberScoop. The company said individuals associated with Chinese company MoonshotAI were behind parts of the attack, but did not offer hard evidence for the claim. https://www.theregister.com/security/2026/09/30/irony-alert-openai-whines-that-chinese-model-stole-its-special-ip-that-it-stole-from-everybody-else/530028516dda7zWed, 30 Sep 2026 21:36:00 GMTThe Register. US model makers can train on web data - but distilling theirs is a 'national security risk' https://www.darkreading.com/cyberattacks-data-breaches/malicious-custom-gpts-chatgpt-rat-delivery-lure10fz6gkWed, 30 Sep 2026 21:25:47 GMTDark Reading. In yet another ClickFix-style campaign, threat actors abuse legitimate domains from OpenAI and Google to fool unsuspecting users.MalwareAI https://www.infosecurity-magazine.com/news/chatgpt-feature-abuse-to-deliver/11lxm6bWed, 30 Sep 2026 11:30:00 GMTInfosecurity Magazine. Cybersecurity researchers at Huntress identify campaign to deliver potent trojan which targets users searching for ChatGPT via GoogleMalwareAI https://www.securityweek.com/anthropic-flags-ai-agent-liability-risks-as-openai-faces-hacking-lawsuit/1ji76c0Wed, 30 Sep 2026 11:19:00 GMTSecurityWeek. Attacks by autonomous AI agents are moving out of the lab and into the courtroom, raising unsettled questions about who is liable for what agents do.AILaw & policy https://www.bleepingcomputer.com/news/security/custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware/1e3qddgTue, 29 Sep 2026 20:59:39 GMTBleepingComputer. Custom variants of OpenAI's ChatGPT promoted in sponsored Google results are directing unsuspecting users to malicious sites that use ClickFix attacks to deliver malware. [...]MalwareAI https://www.securityweek.com/openai-ceo-announces-new-ai-agent-and-avoids-mention-of-security-concerns-at-developer-conference/1ou9eztTue, 29 Sep 2026 20:14:44 GMTSecurityWeek. Altman made a slew of product announcements and updates, including the company’s new agents, called Dots.AI https://therecord.media/openai-apologizes-australia-medicare-breach1yh0mseTue, 29 Sep 2026 19:48:00 GMTThe Record. The artificial intelligence giant acknowledged it botched its response to the incidents and should have done more to promptly notify and work with the Australian government in the days after it discovered the breaches.Breach https://www.theregister.com/ai-and-ml/2026/09/29/openai-benches-gpt-61-astra-for-overstepping-the-mark/5299743sflkbTue, 29 Sep 2026 13:43:00 GMTThe Register. Turns out teaching an AI to keep going can make it rather bad at knowing when to stop https://techcrunch.com/2026/09/29/openai-apologizes-to-australia-after-its-ai-agents-breached-government-sites/ihy28Tue, 29 Sep 2026 12:45:05 GMTTechCrunch Security. The company also detailed how some of those breaches had happened, and outlined additional measures it is taking to assess the impact of the events.BreachAI https://www.theregister.com/ai-and-ml/2026/09/29/openais-dirty-deeds-down-under-included-security-bypass-attempts-using-exposed-keys-source-code-siphon/5299666jqx4omTue, 29 Sep 2026 02:13:51 GMTThe Register. Admits its agents side-swiped four Australian government sites https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat1vw3e2iMon, 28 Sep 2026 20:00:00 GMTHuntress (+3 more sources). Huntress researchers reveal how attackers are exploiting ChatGPT Custom GPTs to spread ClickFix lures and DLL-sideloaded malware. See the full breakdown.ResearchMalwareAI https://www.malwarebytes.com/blog/ai/2026/09/openai-pauses-work-on-top-ai-models-after-agent-slips-past-internet-controls14rpdcxMon, 28 Sep 2026 12:58:12 GMTMalwarebytes Labs. An OpenAI agent bypassed internet restrictions and kept running after an alert. It's another case of AI misalignment no one can afford to ignore.ResearchAI https://www.theregister.com/ai-and-ml/2026/09/28/openai-pauses-some-training-amid-allegations-its-rogue-agents-behaved-more-badly-than-first-thought/52993501xm35bfMon, 28 Sep 2026 05:30:50 GMTThe Register. Amid allegations that agents may have gone off the rails thousands of times, China set up some kind of agentic incident hotline