{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/openai-chatgpt-enterprise/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AWS Bedrock","OpenAI ChatGPT Enterprise","ChatGPT Enterprise"],"_cs_severities":["high"],"_cs_tags":["genai","exfiltration","cloud-security","machine-learning","Defense Evasion","LLM","Prompt Injection"],"_cs_type":"advisory","_cs_vendors":["Amazon","OpenAI"],"content_html":"\u003cp\u003eThe Elastic security_ai integration provides detection capabilities for identifying hex-encoded cryptographic digests (MD5, SHA-1, SHA-256, and SHA-512) within prompts sent to or completions returned by Generative AI services. The presence of these hashes in LLM interactions can serve as an indicator for several malicious activities: passing credential hashes for offline cracking, exfiltrating data fingerprints, or embedding encoded instructions as part of prompt injection payloads.\u003c/p\u003e\n\u003ch2 id=\"investigation\"\u003eInvestigation\u003c/h2\u003e\n\u003cp\u003eSecurity teams should investigate flagged hashes by examining \u003ccode\u003esecurity_ai.hash_string.input_messages.strings\u003c/code\u003e and \u003ccode\u003esecurity_ai.hash_string.output_messages.strings\u003c/code\u003e. Analysis should include reviewing the full conversation context for references to usernames, credentials, or structured exfiltration payloads, and verifying if the hash corresponds to known-bad IOCs.\u003c/p\u003e\n\u003ch2 id=\"false-positives\"\u003eFalse Positives\u003c/h2\u003e\n\u003cp\u003eLegitimate workflows such as security/forensics tools conducting threat intelligence lookups or CI/CD pipelines utilizing git commit SHAs, Docker image digests, or package checksums may trigger this rule. Contextual review is required to verify the nature of the hash.\u003c/p\u003e\n","date_modified":"2026-11-06T21:02:11Z","date_published":"2026-11-06T21:01:52Z","id":"https://feed.craftedsignal.io/briefs/2026-11-genai-hash-detection/","summary":"The security_ai integration for Elastic enables the detection of hex-encoded cryptographic hashes within GenAI prompts and completions, which may indicate credential exfiltration, offline cracking attempts, or encoded prompt injection payloads.","title":"Detection of Cryptographic Hashes in Generative AI Prompts","url":"https://feed.craftedsignal.io/briefs/2026-11-genai-hash-detection/"}],"language":"en","title":"CraftedSignal Threat Feed - OpenAI ChatGPT Enterprise","version":"https://jsonfeed.org/version/1.1"}