Cyber Security News

OpenAI Faces DHS Request to Disclose User’s ChatGPT Prompts in Investigation

Over the past year, federal agents struggled to uncover who operated a notorious child exploitation site on the dark web.

Their search took an unexpected turn when the suspect revealed their use of ChatGPT, marking a significant moment in digital investigations.

Federal Warrant Seeks ChatGPT Data

Last week, in Maine, a federal search warrant was unsealed: Homeland Security Investigations (HSI) requested user data from OpenAI, making it the first known instance where law enforcement sought AI-generated chat logs as evidence.

According to the warrant, undercover agents had been communicating with the site’s administrator when the suspect mentioned using ChatGPT and shared some of its responses.

The prompts discussed by the suspect ranged from innocent questions such as “What would happen if Sherlock Holmes met Q from Star Trek?” to lengthy requests, including a 200,000-word poem.

One highlighted response was a comical, Trump-inspired poem about the Village People’s “Y.M.C.A.,” written in an exaggerated presidential style. The suspect copied and pasted this content during chat sessions with agents.

A snapshot of the poem generated by ChatGPT in the style of President Donald Trump.

HSI’s request to OpenAI included all available information about this user: other conversations with ChatGPT, account names, contact details, and payment records.

The move mirrors previous demands made to search engines like Google for user data but was unprecedented in the realm of generative AI.

Identity Uncovered Without AI Data

Despite the request, investigators didn’t rely on OpenAI’s records to identify the suspect. Through ongoing chats, they discovered revealing details: the suspect had gone through military health assessments, lived seven years in Germany, and had a family history in Afghanistan.

Eventually, the military confirmed the man’s identity. Drew Hoehner, a 36-year-old U.S. military-connected individual, was charged with conspiracy to advertise child sexual abuse material (CSAM). He has yet to enter a plea and his lawyer declined to comment.

HSI, a division within U.S. Immigration and Customs Enforcement focused on child exploitation and cybercrime, had pursued this case since 2019.

Agents believed Hoehner was connected to 15 separate CSAM sites on the encrypted Tor network, with as many as 300,000 users.

The site’s details remain confidential, but it reportedly had well-organized sections, including one for AI-generated illegal material.

OpenAI’s actual response to the government is unclear, though officials did receive a spreadsheet of user data. It’s possible this material could help corroborate charges.

While the prompts OpenAI reviewed were not related to exploitation, AI platforms remain potential targets for abuse.

OpenAI said it reported 31,500 pieces of CSAM content between July and December last year, and responded to 71 government data requests involving 132 user accounts in that time.

Jennifer Lynch, counsel at the Electronic Frontier Foundation, noted that the warrant focused only on two specific prompts from one user.

Still, she said, it signals a growing trend: law enforcement agencies are turning to ChatGPT as a source of evidence, raising new questions about data privacy.

Lynch added, “It’s more important than ever for OpenAI and other AI companies to think about how to limit the amount of data they collect on their users.”

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups

Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…

1 day ago

Anthropic’s Claude AI Uncovers Origins of NSA-Provided Cryptographic Keys After 25 Years

Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…

1 day ago

Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication

Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…

1 day ago

OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root

A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…

1 day ago

GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories

GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…

1 day ago

SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data

Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…

1 day ago