Whoa, AI Misuse! OpenAI Bans China-Linked Hacker Groups "Vixen Panda" and "Keyhole Panda"

Hi, it's Shiichan! Today I've got a bit of an unsettling story for you, an OpenAI report on countering misuse of AI.

OpenAI News openai.com

What was announced?

OpenAI's News reported that it banned accounts linked to threat actors publicly attributed to the People's Republic of China (PRC), known as Vixen Panda and Keyhole Panda. These actors used ChatGPT to support vulnerability research, script writing, translation, and operational troubleshooting. They interacted with the models in both Chinese and English.

Why it matters

Generative AI is really good at writing code and doing research, which also makes it a handy helper for the groundwork behind cyberattacks. What makes this case stand out is that it involves threat actors linked to a nation-state, so it's a real test of how well AI providers can catch and stop misuse with security implications.

What changes

OpenAI disabled all accounts associated with this activity and shared relevant indicators with industry partners. What's notable is OpenAI's own framing: while the investigation gave unusually broad visibility into a network of PRC-affiliated threat actors and their workflows, OpenAI found no evidence that access to its models gave these actors novel capabilities or directions beyond what they could already get from publicly available resources. In other words, ChatGPT wasn't handing out new attack powers, it was acting as a helper for existing work.

Dive Deep

The observed activity came from the same network but split into two main patterns.

• Open-source research support: The actors researched entities and technical topics of interest, and for more technical interactions, used the models to modify scripts or troubleshoot system configurations. This included mentions of reNgine, an automated web reconnaissance framework, and Selenium automation aimed at bypassing login mechanisms and capturing authorization tokens
• Development support activities: This spanned Linux system administration (firewall and nameserver configuration, building software packages for offline deployment), software development (web and Android apps, C and Golang), and infrastructure setup (VPN configuration, software installation, Docker container deployments, and local LLM deployments such as DeepSeek)

The content they generated touched on topics like these.

• Password bruteforcing: seeking help writing a script to try multiple username/password combinations against FTP servers
• Port scanning software: modifying and improving scripts to scan servers for specific ports
• AI-driven penetration testing: automating pentesting by analyzing Nmap scan output, building commands, and iteratively feeding command output back to the LLM to generate new commands
• Social media automation: code to manage a fleet of Android devices and automate operations on social media platforms
• Research into US federal defense, military networks, and government technology: looking up publicly available information on US Special Operations Command, satellite communications technology, ground station terminal locations, government identity verification cards, and networking equipment

OpenAI also mapped these activities to the LLM ATT&CK framework, identifying patterns like AI-assisted vulnerability research, enhanced scripting techniques, infrastructure profiling, strategic planning assistance, and code obfuscation/anti-reverse engineering techniques aimed at malware development.

Wrap-up

• OpenAI banned accounts linked to Vixen Panda and Keyhole Panda, threat actors publicly attributed to the PRC
• They used ChatGPT for vulnerability research, script modification, system troubleshooting, and translation
• Activity fell into two patterns: open-source research support (reNgine, Selenium) and development support (Linux admin, app development, infrastructure setup)
• Use cases ranged from bruteforcing scripts, port scanning, and AI-assisted pentesting to social media automation and research into US defense and government topics
• OpenAI disabled all accounts and shared information with industry partners, but found no evidence the models gave these actors capabilities beyond what's already publicly available

If you're into security and curious how nation-state-linked actors are using AI, this report is worth a read!