Executive Summary
Over roughly eight months, security researchers documented the first confirmed cases of malware using mainstream, commercial AI chatbot platforms as functioning parts of an attack — not just as writing assistants for phishing emails, but as live infrastructure. One backdoor hid its command-and-control traffic inside OpenAI’s Assistants API. Another queried a Hugging Face-hosted model in real time to generate reconnaissance commands on the fly. A third rewrote its own source code every hour using a hard-coded Gemini API key.
Most recently, researchers showed that popular AI assistants requiring no API key at all — including Microsoft Copilot and xAI’s Grok — could be abused as bidirectional relay proxies through their built-in web-browsing features, meaning an infected machine only needs ordinary internet access to route attacker traffic through a trusted AI service.
This is a meaningful shift in the threat landscape: the same AI tools your business may already rely on for productivity are, in a growing number of documented cases, being repurposed by attackers as camouflage, infrastructure, and even active participants in an intrusion.
| Threat Type | AI platform abuse / AI-enabled malware and command-and-control (C2) |
| Time Span Observed | ~8 months, July 2025 – February 2026, per Google’s GTIG AI Threat Tracker |
| Confirmed Malware Families | SesameOp, LAMEHUG, PROMPTFLUX, plus Copilot/Grok relay abuse |
| Platforms Implicated | OpenAI Assistants API, Hugging Face-hosted models, Google Gemini, Microsoft Copilot, xAI Grok |
| Phishing Impact | Roughly 4 in 10 reported phishing attempts now show signs of AI assistance (mid-2026 reporting) |
| Notable Actors | APT28 (LAMEHUG), APT41 (Gemini-assisted C2 tooling), assorted financially motivated groups |
A Fast-Moving, Very New Trend
Unlike ransomware or phishing, which have decades of history to draw on, AI-platform abuse is a genuinely new category of threat that has emerged largely within the past year. It builds on a longer-running trend — attackers using generative AI to write more convincing phishing emails — but has evolved into something more structural: using AI services themselves as the plumbing an attack runs through.
The logic is straightforward from an attacker’s point of view. Security tools are generally very good at flagging traffic to known-malicious domains. They are far less likely to flag traffic to api.openai.com, huggingface.co, or a Microsoft Copilot endpoint, because those are legitimate, widely used services. By hiding inside that traffic, attackers get a form of camouflage that traditional network defenses weren’t built to catch.
What’s Actually Happening: Four Documented Techniques
Security researchers have now confirmed several distinct ways attackers are abusing AI platforms in live intrusions:
• Command-and-control hidden in plain sight: the SesameOp backdoor stored encrypted attacker commands inside OpenAI Assistants API thread objects — legitimate-looking API traffic that most network monitoring tools wouldn’t flag.
• Real-time, AI-generated attack commands: the LAMEHUG implant, linked with moderate confidence to the Russian state-sponsored group APT28, queries a Hugging Face-hosted model to dynamically generate reconnaissance commands as it runs, rather than relying on a fixed, pre-written script.
• Self-modifying malware: the PROMPTFLUX dropper used a hard-coded Gemini API key to instruct the model to rewrite its own source code on an hourly basis, making static detection signatures far less effective.
• AI assistants as relay proxies: researchers demonstrated that Microsoft Copilot and xAI Grok — which require no API key and are broadly accessible — can be weaponized as two-way relay proxies through their native web-browsing capabilities, letting attackers route traffic through a trusted AI service using only anonymous web access from the infected machine.
• AI-assisted C2 development: state-sponsored group APT41 has been observed using Gemini for code-development assistance while building command-and-control infrastructure components for its own custom framework.
| IT’S NOT JUST NATION-STATES Roughly four in ten reported phishing attempts now show signs of AI assistance, and criminal marketplaces increasingly sell phishing-as-a-service kits with a jailbroken language model built in, alongside AI voice-agent services that run automated vishing and one-time-passcode theft at scale. This is no longer a niche, advanced-threat-only problem. |
Why Traditional Defenses Struggle Here
Most network security tooling works by identifying known-bad destinations, unusual traffic patterns, or malware signatures. AI-platform abuse undermines all three at once: the destinations are legitimate and widely allow-listed, the traffic pattern looks like ordinary API usage, and self-modifying, AI-generated code doesn’t hold still long enough to build a reliable signature. This doesn’t mean these attacks are undetectable — it means the detection has to shift toward behavior and context rather than a static blocklist.
MITRE ATT&CK Mapping
| Tactic | Technique | ID |
| Command and Control | Web Service (using a legitimate AI API as a C2 channel) | T1102 |
| Command and Control | Proxy: Multi-hop Proxy (AI assistant as relay) | T1090.003 |
| Defense Evasion | Obfuscated Files or Information: Dynamically Generated Code | T1027.010 (related) |
| Resource Development | Develop Capabilities: Malware (AI-assisted development) | T1587.001 |
Resolution: What Businesses Should Do Now
Most small and mid-sized businesses aren’t the primary target of nation-state tooling like LAMEHUG or PROMPTFLUX — but the techniques trickle down into commodity criminal tooling quickly, and the AI-brand-themed phishing lures already are targeting everyday businesses. Practical steps:
• Treat unexpected AI-brand pop-ups, plugins, or “AI tool” downloads with the same suspicion as any other unsolicited software — Microsoft has tracked active malvertising campaigns using fake AI product names as lures.
• Apply endpoint and email detection that focuses on behavior (unusual outbound API traffic patterns, unexpected use of AI service endpoints from non-development machines) rather than relying solely on domain blocklists.
• If your business builds or uses custom AI integrations, avoid hard-coding API keys in deployable scripts or executables — a hard-coded key was the enabling factor in at least one confirmed malware family.
• Keep phishing awareness training current: assume attackers now have access to flawless, context-aware, AI-generated lures, and shift training away from “look for bad grammar” toward verifying requests through a second channel.
• Ask your IT or security provider whether your monitoring tools have visibility into traffic to major AI platform APIs, since many older security stacks were not built with this traffic pattern in mind.
The Bottom Line for Small Business Owners
AI platforms aren’t inherently dangerous — but attackers have shown, repeatedly and in a very short window of time, that they will use any trusted, widely allow-listed service as cover. The businesses staying ahead of this trend aren’t necessarily blocking AI tools outright; they’re making sure their security monitoring and staff awareness training have caught up to a threat landscape that changed faster than most defenses did.
• Review whether your current security tools have visibility into AI-platform API traffic.
• Refresh phishing training to reflect that AI-generated lures can no longer be spotted by grammar or tone alone.
• Establish a policy for vetting any new AI tools or plugins before employees install them.
