SweetSpecter sent fake support emails to OpenAI staff. OpenAI later linked the campaign’s infrastructure to ChatGPT accounts seeking technical help.
Source: OpenAIProofpoint disclosed the campaign on May 16. OpenAI’s October 9 report later identified its involvement and the actor’s use of ChatGPT.
A help request carried an attachment with a hidden purpose.
Proofpoint Threat ResearchThe attachment concealed software designed to give an intruder remote control.
Proofpoint Threat ResearchOpenAI reports that its email defenses stopped delivery to corporate inboxes.
OpenAIAn illustration: a visitor asks a receptionist to inspect a parcel that contains a hidden recording device. Checking it before delivery can interrupt the plan.
An analogy for the mechanism; not an additional claim about the incident.OpenAI says its defenses blocked the malicious emails before they reached corporate inboxes. OpenAI
The AI helped with supporting tasks; the report does not establish that it wrote the phishing emails.
Targeting is not successful access. This record covers the May campaign, not every operation attributed to SweetSpecter.
Security has to evaluate the request and what it brings with it. A convincing story does not establish permission to run an attachment.
OpenAI banned associated accounts and contacted targeted staff. OpenAI
Editorial defense connection: protect communication channels and turn suspicious messages into a coordinated response.
Combine email, endpoint and identity evidence so responders can investigate a reported message and contain any related activity.
This is a general capability connection, not proof that a particular product would reproduce the reported outcome.
Give staff a trusted channel to verify unusual requests and report suspicious attachments, alongside technical email controls.
The employee framework’s AI-use controls are only indirectly relevant here. The victim cannot govern the outside attacker’s AI accounts.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkExplore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Read this case’s update history →
Reviewed Sep 11, 2026 · Editorial methodology · Structured data