This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A threat actor group known as NullBulge compromised a Disney employee's computer by distributing malware disguised as legitimate AI-art and image-description tools. This malware exfiltrated the employee's credentials, which were then used to access Disney's internal Slack system, resulting in the theft and public release of 44 million internal messages and sensitive corporate data. The breach also led to the public exposure of the employee's personal financial information and his subsequent termination from the company.
A Disney employee, Matthew Van Andel, reportedly downloaded AI-powered malware allegedly developed by the cybercriminal group NullBulge, resulting in a major cybersecurity breach. Hackers purportedly accessed Disney's Slack system, exposing 44 million internal messages, employee and customer data, and financial records. NullBulge also reportedly leaked Van Andel’s personal financial information, leading to identity theft and his eventual termination.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Vulnerabilities that can be exploited in AI systems, software development toolchains, and hardware, resulting in unauthorized access, data and privacy breaches, or system manipulation causing unsafe outputs or behavior.
Also classified as
The attack resulted in the exfiltration and public leak of 44 million internal Disney Slack messages and the employee's personal credentials.
The hackers used the stolen credentials to extort the employee and commit financial fraud by racking up bills on his credit cards.
The threat actors targeted the AI software supply chain by injecting malicious code into legitimate AI repositories and libraries on GitHub and Hugging Face.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by malicious human actors (NullBulge) intentionally distributing malware disguised as AI tools to steal data.
Added categories peak at 2: Minor (Psychological Harm, Indirect)
A cybercriminal group compromised a Disney employee using malware disguised as AI utilities, leading to a 1.2TB corporate data leak. While the incident highlights emerging risks in the open-source AI software supply chain, its national security impact is minor, representing corporate espionage and data theft rather than a threat to national infrastructure, sovereignty, or intelligence.
The AI system (GPT-4 Vision) was integrated into an image description tool that performed specific, well-defined functions on direct input without autonomous planning.
Minimal or No Risk: The underlying AI systems are used for entertainment and simple utility applications like image generation and description, which pose low or negligible risks under the Act.
The employee downloaded software designed to create AI images from text prompts and describe images using GPT-4 Vision.
The reports from SentinelOne and the Wall Street Journal provide highly detailed, complementary technical and personal accounts of the supply-chain attack and its consequences.
None
Technology
Trojanized AI Libraries
Fake OpenAI/Anthropic libraries contained infostealers.
Malicious AI Image Tools
Free AI software on GitHub contained hidden info-stealing malware.
Insecure Discord Webhooks
Exfiltration of stolen credentials via encrypted Discord webhook URLs.
Data Inputs
Compromised Session Cookies
Session cookies harvested from browsers allowed Slack access without 2FA.
Stolen OpenAI API Keys
Stolen API keys were sold on underground forums, compromising AI access.
Malicious Dependencies
requirements.txt was modified to force install malicious custom wheels.
Human Factors
Downloading Unverified Software
Employee downloaded unverified AI tools from GitHub on a personal computer.
Lack of 2FA on Password Manager
1Password account lacked 2FA, enabling total credential compromise.
Poor Home-Work Separation
Using home PC with corporate credentials for experimenting with AI tools.
Process and Methods
Lack of Code Review
Failure to inspect third-party AI repositories and dependencies.
Inadequate Credential Rotation
Lack of regular rotation and monitoring of active corporate credentials.
Management
Inadequate Risk Assessment
Failure to prevent home computers from serving as corporate backdoors.
Account Takeover Vulnerability
Lack of strict device posture checks for accessing internal Slack channels.
Regulatory Environment
Low Scrutiny on Open Source
Public AI repositories lack security standards and active verification.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
