OpenAI has blocked several accounts linked to North Korean hacking groups using ChatGPT to research targets and develop cyberattack tools. Among them are VELVET CHOLLIMA (Kimsuky, Emerald Sleet) and STARDUST CHOLLIMA (APT38, Sapphire Sleet).

Hackers leveraged AI to study cryptocurrency topics, assist in coding remote administration tools (RATs), RDP attacks, phishing, and social engineering. Accounts related to North Korean IT workers attempting to infiltrate Western companies were also banned.

Since October 2024, OpenAI has disrupted over 20 campaigns tied to Iran and China, involving espionage and propaganda content creation.