OpenAI banned likely China-origin accounts using AI to research US persons, locations, and social-engineering tactics.

This case study was originally published in OpenAI’s February 2026⁠(opens in a new window) report on disrupting malicious uses of AI.

We banned a small set of ChatGPT accounts likely originated in China that used our models to request information about US persons, forums and federal building locations, guidance on face- swapping software and generated emails in English that resembled attempts at social engineering. They prompted our models in Chinese language, were mostly active during mainland Chinese business hours and used VPNs to access our platform.

The accounts generated email drafts that purported to be sent from employees of a Hong Kong- based company named “Nimbus Hub Consulting”. However, they prompted our models in Simplified Chinese characters (typically used in mainland China) rather than Traditional Chinese characters (typically used in Hong Kong) suggesting the actual operators were based in mainland China. In addition, one account generated an email purporting to be a representative of a Shanghai-based public relations organization that promotes US-Shanghai economic and cultural exchanges. Based on the company name referencing “Nimbus”, meaning a rain cloud or halo, we named this operation “Silver Lining Playbook”.

Screenshots of LinkedIn profiles affiliated with Nimbus Hub Consulting. Some of the LinkedIn profiles matched individuals listed on Nimbus Hub Consulting’s ‘Our Team’ page.

The accounts generated English language email drafts that were addressed to state-level US officials or policy analysts working in business and finance. They appeared to invite these recipients to participate in paid consultations, which they described as interpreting policy and providing strategic advice for their clients.

Source link