{
 "id": "AIR-2025-0070",
 "slug": "sesameop-backdoor-abuses-openai-assistants-api-for-c2",
 "title": "SesameOp Backdoor Abuses OpenAI Assistants API for C2",
 "summary": "Threat actors utilized a backdoor implant called SesameOp to abuse the OpenAI Assistants API as a covert command and control channel. The malware fetched commands and exfiltrated encrypted results to maintain espionage persistence.",
 "type": "ai_enabled_attack",
 "categories": [
  "other"
 ],
 "severity": 3,
 "targets": [
  "OpenAI",
  "enterprise_deployment"
 ],
 "products": [
  "OpenAI Assistants API",
  "SesameOp"
 ],
 "incident_date": "2025-07",
 "incident_date_precision": "month",
 "first_reported": "2025-12-24",
 "sources": [
  {
   "url": "https://atlas.mitre.org/studies/AML.CS0042",
   "publisher": "MITRE ATLAS",
   "title": "SesameOp: Novel backdoor uses OpenAI Assistants API for command and control",
   "published_at": "2025-12-24"
  },
  {
   "url": "https://microsoft.com/en-us/security/blog/2025/11/03/sesameop-novel-backdoor-uses-openai-assistants-api-for-command-and-control",
   "publisher": "Microsoft Security",
   "title": "SesameOp: Novel backdoor uses OpenAI Assistants API for command and control",
   "published_at": "2025-12-24"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_atlas",
 "tags": [
  "sesameop",
  "openai-api",
  "c2-channel"
 ],
 "created_at": "2026-10-18T06:55:08.239Z",
 "updated_at": "2026-10-18T06:55:08.239Z"
}