The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.
Threat actors are abusing ChatGPT's content-sharing and code-rendering features to host convincing fake outage and download pages on legitimate OpenAI domains. Victims, lured by malicious ads, are tricked into downloading infostealer malware, bypassing security filters and leading to device compromise and credential theft.[AI generated]
Why's our monitor labelling this an incident or hazard?
The event involves an AI system (ChatGPT) whose content-sharing feature is exploited to deliver malware, causing direct harm to users through credential theft and device compromise. The harm is realized, not just potential, as malware infections and stolen credentials have been confirmed. The AI system's design feature is central to the attack vector, making this an AI Incident. The event is not merely a warning or update but documents an active, ongoing campaign causing harm.[AI generated]