12 December 2025 (compiled from Reuters, Engadget, The Hacker News, etc.) As AI assistants become widespread, a new wave of cyberattacks has emerged: attackers have successfully "tricked" mainstream AI models such as ChatGPT, Grok and Gemini into generating seemingly harmless commands that prompt users to "self‑compromise" their devices and silently install data‑stealing malware. On December 10, OpenAI posted a "high risk" alert on its official blog, warning that forthcoming advanced models could be used to develop zero‑day exploits or assist complex intrusions. The incident not only exposed weaknesses in AI security mechanisms but also sounded the alarm across the global cybersecurity community. OpenAI security lead Aleksander Mądry said: "AI's progress is a double‑edged sword; we must build defenses in advance to prevent it from becoming an accomplice to attackers." According to security firm Huntress, such attacks have led to at least hundreds of Mac users being infected with the AMOS stealer, with losses including passwords, browser histories and cryptocurrency.
Origin of the Attacks: From "Harmless Conversations" to Malicious Chains
The root of this wave can be traced to mid‑November security research, but it has recently evolved into large‑scale operations. The attackers' strategy is highly covert: they begin with "friendly" conversations with AI models about common user pain points such as "how to clear disk space on a Mac" or "optimize Windows performance." In responses, the AI naturally generates terminal command suggestions, for example "run this script to free up space." Attackers then share screenshots or links of these dialogues publicly and use Google ad placements to promote them so they appear prominently in related searches.
When a user searches for "clear disk space on Mac," the top result is often a "sponsored ChatGPT guide" that, when clicked, displays AI‑generated steps: copy and paste an "optimization" command into the terminal. Unbeknownst to the user, the command embeds backdoor logic—it downloads and executes the AMOS stealer (Atomic macOS Stealer), which can quietly exfiltrate Keychain passwords, browser cookies and wallet data without requiring a file download or suspicious attachment click. Engadget reported that these "search‑friendly" links exploit users' trust in Google and AI, bypassing traditional antivirus alerts. Huntress researcher John Hammond found that similar attacks also work on Grok and Google Gemini: given the same prompts, the models reproduce malicious commands with success rates up to 90%.
A deeper issue is indirect prompt injection. The Hacker News described seven major ChatGPT vulnerabilities on November 5 that serve as fertile ground for such attacks. These vulnerabilities affect GPT‑4o and GPT‑5 models and include injecting malicious instructions via trusted website comment sections, zero‑click search‑context injection, one‑click link bypasses (e.g. "chatgpt.com/?q={malicious prompt}"), security‑mechanism circumvention (using Bing domain whitelists to mask malicious URLs), conversation injection (embedding malicious prompts in site summaries to influence subsequent interactions), malicious content hiding (exploiting Markdown rendering bugs to conceal instructions) and memory poisoning (contaminating user memory to exfiltrate private data). Attackers do not need direct access to the models; by "polluting" public content they can make AI unknowingly "betray" users. Tenable researcher Moshe Bernstein warned: "This is not the AI's fault, but a systematic blind spot in human‑designed systems."
On X, security expert @gridinsoft shared a case of AMOS spreading via "AI poisoning": attackers forged update guides to trick users into running commands, stole data and then remotely controlled the devices. Another user, @carmelkron, described: "Hackers have turned Google, ChatGPT and Grok into Mac traps; users think they are optimizing their machines, but are actually installing stealers themselves."
OpenAI's 'Vaccine': High‑Risk Alert and Defense Upgrades
In response to the threat, OpenAI spoke up first on December 10, classifying the cybersecurity risk of new models as "high" in its blog. The company noted that as capabilities of models like GPT‑5.2 increase exponentially, they could autonomously develop zero‑day remote vulnerabilities targeted at hardened systems or assist enterprise‑grade intrusions—for example automating penetration testing, credential theft and lateral movement, which could lead to real‑world damage such as industrial control system outages. Reuters cited OpenAI's report: "AI is no longer merely an assistive tool but a potential amplifier for attacks; attackers can use it to generate customized payloads and lower the barrier to intrusion."
The warning is not hypothetical. OpenAI acknowledged that current models perform well on defensive cybersecurity tasks such as code review and patching, but their offensive potential is more worrying. The company has fixed some ChatGPT vulnerabilities, including strengthening Markdown rendering and Bing link verification, but emphasized that "zero‑day risk cannot be completely eliminated." To respond, OpenAI launched multi‑layered defenses: first, model hardening that prioritizes defensive scenario data; second, infrastructure upgrades including access controls, outbound filtering and real‑time monitoring; third, ecosystem tools such as automated auditing platforms to help developers detect prompt injection. The company also announced the establishment of a Frontier Risk Council to involve cybersecurity experts in assessments and introduced a tiered access program—qualified security practitioners can gain prioritized access to enhanced features.
Other tech giants moved quickly. xAI (developer of Grok) replied on X that it will strengthen moderation of shared conversations; Google said it has added command verification layers to Gemini's search integration. Anthropic's Claude model was not directly implicated, but an October report noted that Chinese threat actors had used similar techniques to automate attacks. LinkedIn expert Saurabh Anand analyzed: "Once the AI's chain of reasoning is hijacked, security signals weaken—this is not just a technical issue but an ethical one."
Global Impact: From Personal Privacy to National Security
The impact is wide‑ranging. At the individual level, user privacy is most at risk: the AMOS stealer has infected hundreds of devices and caused losses exceeding a million dollars, including drained crypto assets. Corporate risk is greater: attackers can use AI to generate targeted phishing scripts or exploit chains, accelerating supply‑chain attacks. NDTV reported that if industrial control systems such as power grids were compromised, consequences could be catastrophic.
At a macro level, the incident highlights the urgency of AI governance. IDC projects that by 2026 AI‑related cyberattacks will account for 30% of total attacks, with economic losses over $500 billion. The EU and the U.S. are pushing new regulations requiring AI models to incorporate red‑team testing mechanisms. Chinese hacker groups (such as APT41) have been accused of leveraging open‑source AI tools to automate intrusions; AOL reported they "turned AI into an attack machine." An X user, @mattjay, noted that malicious LLMs like WormGPT can be bought for as little as $220 to generate ransomware scripts, dramatically lowering the barrier to attack.
Experts urge users to be cautious: do not blindly trust AI‑generated commands and always verify sources; organizations should deploy prompt‑injection detection tools. India Today commented: "OpenAI's alert is timely, but industry‑wide collaboration is needed to turn the tide."
Outlook: An AI Security 'Arms Race'
OpenAI's "code red" status (an internal directive from December 2) has persisted for a week as the company rushes to iterate GPT‑5.2's safety modules. Going forward, AI defense may become a new competitive field: moving from passive filtering to active "honeypot" deception. TechCentral suggested the crisis could spur an "AI Security Alliance" to share threat intelligence. On X, @aiwithmayank warned: "Reasoning‑chain attacks compromise all models; fixes must start at the activation layer."
Hackers' "AI traps" remind us that technological double‑edged swords require careful control. OpenAI's preventative measures are timely, but the cybersecurity battlefield has shifted from bits to intelligence—whoever builds the first strong walls will shape the future.
▶️ Enjoyed this article? Creating great content takes effort!
Subscribe to our YouTube channel:
AI Rosetta
Your likes, subscriptions and shares mean the world to us! 🙏
For more AI news, visit:
https://www.airosetta.com