New SesameOp Backdoor Abused OpenAI Assistants API for Remote Access
Source Reddit InfoSec News
Description
The SesameOp backdoor malware abuses the OpenAI Assistants API to gain remote access to compromised systems. This novel technique leverages legitimate AI service APIs as a covert communication channel, complicating detection and mitigation efforts. Although no known exploits in the wild have been reported yet, the backdoor's use of a trusted API could allow attackers to bypass traditional network defenses. The threat is currently assessed as medium severity due to the potential for unauthorized remote control without requiring user interaction, but with limited evidence of widespread exploitation. European organizations using OpenAI services or integrating AI assistants into their infrastructure may be at risk, especially those in technology, finance, and critical infrastructure sectors. Mitigation requires monitoring unusual API usage patterns, restricting API keys, and implementing strict network segmentation. Countries with high AI adoption and digital infrastructure, such as Germany, France, the UK, and the Netherlands, are more likely to be targeted. Defenders should prioritize detection of anomalous outbound traffic to AI service endpoints and enforce least privilege principles on API credentials.