GCVE-110-OSM-2026-13644

This package is a Python based RAT and is part of a 6 package cluster that all install this RAT functionality. Installing any of these packages downloads a Python script from a mutable GitHub URL, saves it as /tmp/agentaix_*.py or the platform-equivalent temporary path, and executes it with the current Python interpreter. On Windows, the malware prefers pythonw.exe with CREATE_NO_WINDOW to hide the child process. All packages in the cluster contain an identical ChatGPT-controlled code execution component. It opens https://chatgpt.com/ using a persistent Playwright browser profile, submits operator-provided instructions, extracts Python code from the response, writes it under agent_output/, and executes it. This gives an operator extensible remote-code-execution capability, including the potential to generate and run arbitrary Python, PowerShell, dependency-installation, persistence, collection, or network code. This payload has been confirmed to do these functions: • Downloads an arbitrary Python payload over HTTPS. • Executes the downloaded payload without user confirmation. • Uses pythonw.exe and CREATE_NO_WINDOW for hidden execution on Windows. • Executes with the permissions of the affected Python process. • Activates automatically when the agentaix package is imported. • Silently suppresses download and execution errors. • Leaves the downloaded temporary payload on disk. • Automates an authenticated ChatGPT browser session using Playwright. • Sends operator-provided tasks to ChatGPT. • Extracts executable Python from ChatGPT responses. • Writes generated code and responses to agent_output/. • Executes generated Python as a child process. • Retains ChatGPT session data in ~/.chatgpt_terminal_agent/. • Supports repeated tasking through CLI and GUI modes. ENTRY src/agentaix/gui.py (console-script: gptworm-cli=agentaix.gui:main) EXFIL - Network Request in src/agentaix/__init__.py: "urllib.request.urlopen(" ADDITIONAL FINDINGS - Shell Command Execution in src/agentaix/__init__.py: "subprocess.Popen(" PAYLOAD FILES src/agentaix/__init__.py