Microsoft finds backdoor using OpenAI Assistants API for C2 communications

Microsoft revealed Monday that the OpenAI Assistants API was abused by a threat actor to facilitate command-and-control (C2) communications with a backdoor dubbed SesameOp.

The OpenAI Assistants API allow developers to create custom AI agents called "Assistants" that are powered by OpenAI’s models. The Assistants API is scheduled to be deprecated and replaced by the Responses API in August 2026.

In the case of SesameOp, rather than leveraging the AI models themselves, the attackers used fields such as Assistant descriptions, custom instructions and messages to Assistants to store information including commands to be executed by the backdoor malware.

This backdoor was discovered during a Microsoft Incident Response – Detection and Response Team (DART) investigation into a “sophisticated security incident” in July 2025, according to Microsoft. This incident involved the use of Microsoft Visual Studio utilities that had been compromised with malicious libraries, and hunting through other utilities loading suspicious libraries ultimately led to the discovery of SesameOp.

The malware consists of a loader, Netapi64.dll, and the .NET-based backdoor OpenAIAgent.Netapi64. The loader is obfuscated using a tool called Eazfuscator.NET and is loaded at runtime into a legitimate host executable via .NET AppDomainManager injection.

The loader creates a mutex to prevent duplicate infections and searches C:\\Windows\Temp for a file ending in Netapi64, which it then XOR-decodes and runs to launch the backdoor.

SesameOp references an embedded configuration file to retrieve the OpenAI Assistants API key, as well as a proxy address, and uses the key to access the API and create a new Assistant with the name being the base64-encoded hostname of the victim’s machine.

Once this Assistant is created, the attacker can edit the Assistant’s description and instructions, as well as create new chat threads and send messages containing encoded commands for the backdoor to retrieve.

As the backdoor continues to query the API for the list of Assistants on the attacker’s account, it will read the description field of the Assistant it originally created that contains the victim’s encoded hostname and perform different actions depending on what it contains.

If the description reads “SLEEP,” the malware will read the Assistant’s instructions field, which contains a thread ID and message ID separated with [._.]. The backdoor then retrieves the specified message within the specified thread, locates the metadata field “timeSLEEP” and uses that value to perform a thread sleep operation.

If the description says “Payload,” it will also retrieve a thread and message ID from the instructions field and parse the specified message, which contains a base64-encoded and RSA encrypted AES key and a compressed, base64-encoded, AES encrypted dictionary, separated by a space.

Once these elements are retrieved, the malware deletes the message and the Assistant and uses a hardcoded RSA key to decrypt the AES key, which is then used to decrypt the dictionary element. This dictionary undergoes additional deobfuscation steps before being passed, along with a dictionary key (OpenAIAgent.aaazzz) contained in the backdoor’s config file, to the executeWithJScriptEngine method, which invokes the Framework method to ultimately select the script to be executed via Eval.JScriptEvaluate.

The result of the execution is encrypted, compressed and encoded in a similar manner to the original dictionary and posted, along with its encrypted AES key, as a new message to the same thread ID from which the payload message was retrieved. The backdoor then creates a new Assistant with the same base64-encoded hostname, the description “Result” and the instructions field populated with the thread ID and new message ID separated with [._.].

This novel use of the OpenAI Assistants API as a C2 channel enables the attackers to avoid hosting their own infrastructure and allows their illicit communications to potentially blend in with legitimate API traffic. Microsoft noted that the attackers did not exploit any vulnerability in the API but instead abused its built-in capabilities for malicious purposes.

OpenAI jointly investigated SesameOp alongside Microsoft and ultimately disabled the API key and an associated account linked to the malware.