On Friday, OpenAI, the parent company of ChatGPT, announced that it has banned accounts potentially involved in deceptive employment schemes. The identified threat actors include users suspected to be linked to China and North Korea.

According to a February 14 report by the artificial intelligence firm, the company is reviewing its AI models to ensure they are not being exploited for malicious purposes.

OpenAI’s Security Concerns

ChatGPT, OpenAI’s flagship AI chatbot, has become the most widely used AI tool, with over 400 million weekly active users. The company is currently attempting to raise $40 billion at a $300 billion valuation, a potential record-breaking funding round for a private company.

As OpenAI’s influence grows, so do concerns about the potential misuse of its AI technology by authoritarian regimes. The company has now taken steps to curb the malicious use of its models, particularly in surveillance and influence operations.

AI Being Used for Deceptive Tactics

OpenAI has not disclosed the number of accounts banned or the duration of their activities. However, the report detailed various instances where malicious actors leveraged AI to advance their deceptive operations.

In one case, ChatGPT-generated Spanish-language news articles were published by mainstream news outlets in Latin America under a Chinese company’s byline. These articles sought to discredit the United States.

In another instance, actors linked to North Korea created fraudulent job applicant profiles using AI-generated resumes and cover letters to obtain jobs at Western companies. The goal of this scheme was to funnel income into North Korea's financial networks.

https://usaherald.com/firing-squad-execution-south-carolina-death-row-inmate-chooses-death-by-gunfire/

North Korean IT Worker Scheme

In an updated report, OpenAI highlighted North Korea’s ongoing efforts to deploy IT workers overseas under false pretenses. The actors in question generated personal documentation for fictitious job applicants, including resumes, online job profiles, and cover letters.

"The activity we observed is consistent with the tactics, techniques, and procedures Microsoft and Google attributed to an IT worker scheme potentially connected to North Korea," OpenAI stated in its report, "Disrupting Malicious Uses of Our Models."

The company further explained, "While we cannot determine the locations or nationalities of the actors, the activity we disrupted shared characteristics publicly reported about North Korean state efforts to funnel income through deceptive hiring schemes, where individuals fraudulently obtain positions at Western companies to support the regime’s financial network."

Additionally, OpenAI noted that the perpetrators used social media to recruit individuals willing to lend their identities or host laptops to help job applicants pass background checks. The AI models were even used to prepare responses for technical and behavioral interview questions.

Impact on International Security

The timing of this report aligns with increased efforts by Seoul and Washington to counter North Korea’s deceptive overseas IT operations. These fraudulent activities are believed to be a significant revenue source for the regime’s nuclear and ballistic missile programs.

The banned actors generally used OpenAI’s services for various technical purposes, including querying open-source information, translating content, finding coding errors, and executing basic coding tasks.

Additional Threat Actors Identified

OpenAI’s investigation uncovered multiple cyber threat actors exploiting its services:

• Charcoal Typhoon: Researched companies and cybersecurity tools, debugged code, generated scripts, and created phishing-related content.
• Salmon Typhoon: Translated technical papers, retrieved publicly available intelligence agency data, assisted with coding, and researched methods to obscure processes on a system.
• Crimson Sandstorm: Used AI for web and app development scripting, generated phishing campaign content, and researched malware evasion techniques.
• Emerald Sleet: Identified defense experts and organizations in the Asia-Pacific region, researched vulnerabilities, assisted with scripting, and drafted phishing content.
• Forest Blizzard: Focused on open-source research into satellite communication protocols and radar imaging technology, along with scripting support.

As AI technology advances, so do the risks associated with its misuse.

OpenAI’s removal of the threat actors marks an important step in protecting against AI-driven cyber threats. However, the battle against malicious actors leveraging AI for deceptive purposes is ongoing. 

The tech industry and global security agencies must continue working together to prevent authoritarian regimes from weaponizing AI against the US as well as, their own citizens.