MisbehaviorSerious2 sourcesFirst seen
ChatGPT Joins a Botnet It Never Agreed To Join
Ourtake
The command-and-control server was a GitHub issues tracker. Free hosting, and the memory feature did the rest.
What happened
A security researcher demonstrated that prompt injection hidden in a GitHub issue could persist malicious instructions in ChatGPT's long-term memory, turning instances into remotely controlled bots. The payload polled GitHub issues as a command-and-control channel, invoked tools, and leaked data via an Azure Blob Storage bypass of url_safe. The findings were disclosed to OpenAI in October 2024.