SesameOp: Novel backdoor uses OpenAI Assistants API for command and control

Microsoft Incident Response – Detection and Response Team (DART) researchers uncovered SesameOp, a backdoor that uses the OpenAI Assistants API as a covert command-and-control channel rather than traditional infrastructure. According to Microsoft’s analysis, the loader Netapi64.dll and the backdoor OpenAIAgent.Netapi64 form the core, with the latter retrieving commands via OpenAI Assistants API, decrypting and executing them locally, and then posting results back to OpenAI.

The backdoor, discovered in July 2025 after a long-running compromise, employs a complex chain including .NET AppDomainManager injection, payload compression, and layered encryption to stay under the radar. It creates a vector store in OpenAI and enumerates Assistants to coordinate instructions, using the description field to flag actions such as SLEEP, Payload or Result, and it even posts results to a new OpenAI message tied to a thread ID and message ID.

The OpenAI Assistants API is being deprecated in August 2026, and Microsoft and OpenAI say they continued collaboration to disrupt such misuse of emerging technologies.