Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Incident overview
The Microsoft Incident Response - Detection and Response Team (DART) investigated a compromised system where a threat actor utilized SesameOp, a backdoor implant that abuses the OpenAI Assistants API as a covert command and control channel, for espionage activities. The SesameOp malware used the OpenAI API to fetch and execute the threat actor's commands and to exfiltrate encrypted results from the victim system.
The threat actor had maintained a presence on the compromised system for several months. They had control of multiple internal web shells which executed commands from malicious processes that relied on compromised Visual Studio utilities. Investigation of other Visual Studio utilities led to the discovery of the novel SesameOp backdoor.
Why this record has no ERS
The compromised asset is a conventional Windows host; the hosted AI API serves only as a command-and-control channel, and no control outcome of the provider is reported. The record fails the system and observation tests of the scorability admission test and is retained as threat context.
Status: Not scorable by design · Classification: Incident · source date 2026-08-06 · primary evidence date 2025-07-01
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The flow documents what happened and which controls apply; it does not establish an assessed deployment.
| MITRE ATLAS case study | AML.CS0042 (incident) |
|---|---|
| Target | OpenAI Assistants API |
| Actor | Unknown Threat Actor |
| Reporter | Microsoft Incident Response - Detection and Response Team (DART) |
| Primary evidence date | 2025-07-01 |
| SecureFlow record updated | 2026-08-06 |
| AI layers | Autonomous agents |
| Risk impact | System compromise / RCE, Resource hijacking / cost |
| Affected components | OpenAI Assistants API, SesameOp backdoor implant, compromised Windows host, external AI service egress path |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Relay C2 via OpenAI Assistants APIThe threat actor abused the OpenAI Assistants API to relay commands to the SesameOp malware, which executed them on the victim system, and sent the results back to the threat actor via the same channel. Both commands and results are encrypted. SesameOp cleaned up its tracks by deleting the Assistants and Messages it created and used for communication. | AML.TA0014 AML.T0096 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0042-sesameop-openai-assistants-api-c2; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0042 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-I-002.002 | Secure External AI Service ConnectivityExact SecureFlow defense-map identifier (flow atlas-aml-cs0042-sesameop-openai-assistants-api-c2), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-1. Presence supplies no score credit. | Candidate evidence route | Cn-4 |
| AID-D-005.009 | AI-Service C2 & Abuse-Channel DetectionExact SecureFlow defense-map identifier (flow atlas-aml-cs0042-sesameop-openai-assistants-api-c2), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-1. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-I-003.001 | Detection-Driven Quarantine & Safe-Mode DowngradeExact SecureFlow defense-map identifier (flow atlas-aml-cs0042-sesameop-openai-assistants-api-c2), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-1. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-6 Cn-7 |