NIK C2 malware uses the OpenAI API for theft and remote control
Cisco Talos says the Go implant can bill a victim’s OpenAI key, log keys, and show a non-encrypting lock screen.
72
Product
OpenAI API
- Mentions · 7d5
- Mentions · 30d8
- All mentions12
- First seenAug 12, 2026
- Last mentioned15h ago
Timeline
12 articles · newest firstResearchers extract hidden GPT-5.6 reasoning through an OpenAI API flaw
OpenAI confirmed the bug, paid Xint a $6,000 bounty, and deployed an undisclosed fix on October 23.
62
OpenAI compaction flaw let researchers extract hidden model reasoning
Xint hid GPT-5.6 Sol reasoning in a compaction and recovered it through GPT-4.1 and GPT-4o; OpenAI paid $6000.
62
OpenAI API compaction flaw leaked hidden model reasoning traces
Xint says OpenAI confirmed the bug, paid $6,000, and shipped an undisclosed fix on October 23.
58
Researchers bypass OpenAI’s August fix for reasoning-trace theft
Xint recovered raw traces from gpt-4.1 and gpt-4o via compaction and tab substitution; OpenAI confirmed, mitigated, and paid a bounty.
58
Localiza reorganizes work with ChatGPT Enterprise and 60+ agents
OpenAI says the mobility firm also uses its API and Codex for AI-native experiences.
16
A model guide for the GPT-6 family
OpenAI's guide explains how to choose GPT-6 Astra, Sol, or Luna and run them in production.
58
How Albertsons Companies is reimagining retail from the inside out
OpenAI and Albertsons are adding a Safeway shopping experience inside ChatGPT plus enterprise AI tools.
52
Expanding OpenAI Academy with new learning paths
OpenAI expanded Academy with courses for developers, leaders, educators, and students.
36
Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms
Datadog researchers document two unauthenticated, AI-built credential harvesting dashboards, Loot and UltraVault, holding 42,000+ stolen secrets and actively abusing AWS and AI keys.
72
Offering Zero Data Retention for frontier models
OpenAI reaffirms Zero Data Retention for eligible API customers and previews Private Safety Processing that runs safety checks without retaining data.
40
OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning
Researchers show encrypted reasoning blocks in OpenAI, Anthropic, and Google APIs can be replayed to recover hidden reasoning and secrets like API keys.
68
Related CVEs
by mentions- CVE-2026-4890785%10.0Unauthenticated PHP Code Upload and Execution in Joomla Content Editor (JCE)
- CVE-2025-55182100%10.0Unauthenticated RCE in React Server Components (React2Shell)
- CVE-2026-6303011%9.8WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
- CVE-2026-601375%5.9WordPress Core SQL Injection via WP_Query author__not_in (CVE-2026-60137)
- CVE-2026-6463831%8.9Pre-Auth Reflected XSS in WordPress Login Screen Can Escalate to RCE
Appears with
- OpenAIvendor · 12
- Xintorganization · 4
- OpenAIorganization · 4
- gpt-4.1ai model · 4
- gpt-4oai model · 4
- Codexproduct · 3
- Googlevendor · 2
- gpt-5.6-solai model · 2
- Anthropicvendor · 2
- ChatGPTai model · 2
- ChatGPTproduct · 2
- ChatGPT Enterpriseproduct · 2
- Reconmalware · 1
- GPT-6 Lunaai model · 1
- Google Threat Intelligence Grouporganization · 1
- GPT-6 Astraai model · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.