A Flaw in ChatGPT’s Mac App Could Have Let Hackers Grab Sensitive Data
ChatGPT's Mac app had a vulnerability allowing attackers to access chat logs and run commands.
A recently patched vulnerability in OpenAI's ChatGPT macOS app could have allowed attackers to gain full control of the application on a victim's machine. The flaw, discovered by Objective-See Foundation, enabled unprivileged code to access chat logs, browser sessions, and execute commands by exploiting a trusted script interpreter component. OpenAI has since released a fix, acknowledging the need to accelerate security practices as AI software becomes a more prominent target.
AI summary of the linked source. Not reviewed by an editor. How this works
Run OpenAI?
Get an email when a new story names OpenAI, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA vulnerability in OpenAI's ChatGPT macOS application allowed unprivileged code to hijack a trusted script interpreter component, granting attackers full control of the app and access to sensitive user data including chat logs and active browser sessions. The flaw highlights the risk of insufficient inter-process privilege separation in desktop AI applications, which are rapidly becoming high-value targets due to the sensitive data they handle. As AI tools are increasingly embedded into daily workflows, they expand the attack surface significantly — often before security practices have matured to match. OpenAI's response underscores a broader industry challenge: AI product development cycles frequently outpace security validation processes.
What helps against this
How we list vendors- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.