When a legitimate invitation lands in an employee's inbox — sent from a verified platform address, passing every authentication check — the instinct to trust it is almost automatic. That instinct is exactly what a new class of social engineering attack is designed to exploit. A campaign researchers are calling the "Poisoned Tenant" attack is weaponizing OpenAI's own organizational invitation system to lure corporate employees into attacker-controlled ChatGPT workspaces, where the data they submit could be extraordinarily valuable.
How the Attack Works
The mechanics are deceptively simple — and that simplicity is what makes them dangerous. Threat actors register new OpenAI tenants using free Gmail accounts, naming those tenants after specific target organizations to create the appearance of a legitimate corporate workspace. They then invite individual employees — identified through prior reconnaissance — using those employees' real work email addresses.
The invitation itself is completely genuine. It originates from OpenAI's own notification infrastructure and carries all the hallmarks of legitimacy: correct sender address, valid email authentication headers, and formatting identical to a standard organizational onboarding message. No spoofed domain. No suspicious attachment. No grammatical red flags.
OpenAI does include a cautionary note indicating that the inviter's email domain does not match the recipient's organization — but that warning is rendered as a single, easy-to-overlook line buried within the body of an otherwise normal-looking email. For a busy professional expecting corporate IT communications, it is the kind of detail that disappears in peripheral vision.
Inside the Fraudulent Workspace
Researchers who accepted one of these invitations found a carefully constructed environment. Upon joining, the recipient is immediately added to the fraudulent organization and granted Owner-level privileges — full administrative access to the tenant. A single attacker-controlled account, posing as the organization's CEO, is present in the workspace. A legitimate Visa credit card is attached to the billing account, enabling premium features and removing yet another potential alarm bell.
"An attacker who just wants to spray scam content through a trusted email channel doesn't name the organization after their target, research individual employees, or attach a credit card. That investment only pays off if employees actually join and start using it."
The workspace itself contained no pre-loaded content — no planted documents, no pre-staged chats. That absence actually reveals the strategy: the attackers are not delivering a payload. They are building a collection vessel. The goal is to wait for employees to begin using the workspace as if it were a sanctioned corporate tool, feeding it source code, internal documents, strategic plans, customer data, and security research in the ordinary course of their workday.
Why This Attack Is So Difficult to Detect
Traditional phishing relies on impersonating a sender. This attack impersonates an environment — and does so using the target platform's own legitimate infrastructure. That distinction matters enormously for defenders:
The campaign also reflects a maturing attacker playbook around what researchers call legitimate infrastructure abuse — the systematic exploitation of trusted SaaS notification and invitation pipelines. Attackers have long abused Google Docs sharing, Dropbox notifications, and calendar invites. The extension of this tactic to AI platforms represents a logical and troubling escalation, given the sensitivity of what employees routinely submit to AI assistants.
Who Is Being Targeted?
Reports indicate that the organizations receiving these fraudulent invitations are concentrated in the cybersecurity and technology sectors. That targeting pattern is significant. Cybersecurity professionals routinely process sensitive client data, vulnerability research, threat intelligence, and internal tooling — precisely the categories of information that would be most valuable if silently exfiltrated through an AI prompt interface. Targeting the defenders first is not incidental; it is strategic.
What You Should Do
Organizations and security teams should treat this campaign as a signal to revisit their AI governance posture. Specific actions to take now:
- Brief employees immediately on the existence of fraudulent AI workspace invitations, emphasizing that legitimate-looking does not mean verified.
- Establish a verification protocol for any unsolicited invitation to join an organizational workspace on any SaaS platform — AI or otherwise. Employees should confirm through an internal channel before accepting.
- Audit SaaS membership across your organization. If you lack visibility into which AI platforms your employees are using and which organizations they have joined, that gap needs to close.
- Define approved AI workspaces explicitly and communicate them company-wide. Employees should know which tools are sanctioned and be skeptical of any invitation that falls outside that list.
- Review your AI acceptable use policy to ensure it addresses not just data submission practices but also how employees should handle unexpected platform invitations.
- Monitor for domain-mismatched invitations by working with your email security vendor to flag or quarantine SaaS invitations where the inviter domain does not match the invitee's organization.
OpenAI and other AI platform providers bear responsibility here as well. The ability to register a tenant under any organization's name without verification is an inherent structural risk. Robust controls — such as domain verification requirements, rate limits on organization creation, or enhanced warning mechanisms for domain mismatches — would meaningfully raise the cost of this attack class.
Until those safeguards exist at the platform level, the defensive burden falls on organizations themselves. The Poisoned Tenant campaign is a reminder that in the AI era, the attack surface is not just your network or your endpoints — it is every prompt your employees type into a workspace they believe is theirs.
