Salmon Typhoon used ChatGPT for research, scripting and phishing content

Confirmed

OpenAI and Microsoft both state the accounts were tied to this actor; activity was limited, non-novel assistance.

The China-affiliated group used ChatGPT to translate technical papers, gather public information on intelligence agencies, help with code, and research ways to hide processes on a system.

“Salmon Typhoon used our services to translate technical papers, retrieve publicly available information on multiple intelligence agencies and regional threat actors, assist with coding, and research common ways processes could be hidden on a system.”OpenAI

Sources

Disrupting malicious uses of AI by state-affiliated threat actorsOpenAI · 14 Feb 2024 · primary source
Staying ahead of threat actors in the age of AIMicrosoft Security Blog · 14 Feb 2024 · primary source

Date: Feb 2024
Disclosed: 14 Feb 2024
Actor: Salmon Typhoon (nation state), as attributed by OpenAI
Nexus: China
Targets: Government and defense-related targets (per source)
What the AI did: Recon, Malware dev, Evasion
Model: ChatGPT (OpenAI services)
Model family: OpenAI
Model basis: stated by vendor
Autonomy: assist
Outcome: OpenAI accounts disabled in coordination with Microsoft.