Vulnerability in ChatGPT's macOS App Exposes User Data to Attackers

Recent events have highlighted the vulnerability of artificial intelligence applications as targets for cybercriminals. A newly discovered flaw in the macOS version of OpenAI's ChatGPT software exemplifies this risk, enabling potential attackers to gain unauthorized access to sensitive user data, including chat logs and other stored information. This incident underscores the critical nature of security measures within AI applications as their adoption continues to expand.

Researchers from the Objective-See Foundation uncovered the vulnerability, which would have permitted an attacker to effectively seize control of the ChatGPT application installed on a victim’s computer. By leveraging this flaw, attackers could not only exploit chat histories but also extract browser sessions and other data interconnected with the application. This situation exemplifies the significant access and trust AI platforms have, making them lucrative targets for cyber attacks.

Patrick Wardle, a software analyst at Objective-See and an experienced researcher in macOS security, stated that, “Agents need a lot of access to do their job. They’re like the building manager who has keys to all rooms. If an agent can be corrupted or compromised, it can lead to severe issues where unauthorized code can access sensitive resources.” This analogy highlights the elevated risk associated with the permissions granted to AI applications, which have to interact with multiple system components.

OpenAI acknowledged the security vulnerability and its fix via a system change log on September 25. According to Shane Bauer, an OpenAI spokesperson, “We continue to evolve our security practices, but we recognize a need to move faster.” This statement reveals an awareness of the pressing need for proactive security solutions in the face of such vulnerabilities.

Technical Details of the Vulnerability

The architecture of the macOS ChatGPT app includes several components communicating securely through digital signature checks. These checks are intended to authenticate that both parties involved in data exchange are legitimate OpenAI components, effectively preventing any unauthorized software from making requests. The signature verification process occurs at three separate layers, which aims to thwart any malicious attempts to hijack communication between components.

However, the researchers discovered a significant gap: a script interpreter that is designed to interact with trusted scripts unexpectedly accepted untrusted commands. By manipulating the script interpreter and invoking it multiple times, attackers could bypass the checks that were meant to secure the communication layers. This flaw does require that an attacker has already installed malware on the victim's machine, making it a secondary vertical approach that exploits existing vulnerabilities rather than a standalone attack.

Wardle expressed concerns about how easily this vulnerability could be exploited, describing it as “insanely trivial.” His proof of concept only required around a dozen lines of code to demonstrate the potential for exploitation. With access granted through this flaw, an attacker could execute commands within the ChatGPT ecosystem as if they were legitimate requests, thereby compromising not just the application itself but potentially accessing browser sessions and other sensitive applications as well.

Broader Implications and Future Risks

Wardle is set to present his findings, including other AI-related macOS vulnerabilities, at an upcoming Apple-focused security conference, Objective by the Sea, scheduled for November. This growing body of research emphasizes a recurring theme: AI companies are rapidly innovating and expanding features without proportionately addressing security concerns. Wardle notes, “AI companies are fixated on adding features right now. But as always, the more features, the broader the attack surface. All of these companies need to be fully focused on security, and from what I can see, it often seems like an afterthought.”

OpenAI is currently reviewing a separate vulnerability report submitted by Wardle that pertains to the integration of ChatGPT with its new Dots AI assistant, signifying that ongoing security evaluations remain essential as these applications evolve. As the complexity of AI applications increases, the challenges in securing these systems burgeon, further raising the stakes for both developers and users alike.

As this incident illustrates, organizations developing AI technologies must prioritize building resilient security infrastructure to protect against the evolving landscape of cyber threats that target AI applications. The implications of such vulnerabilities extend beyond unauthorized data access; they may also jeopardize user trust in AI platforms, which increasingly permeate both personal and professional environments. Addressing these security vulnerabilities needs to be prioritized to safeguard users against potential breaches as the technology matures.

Update: 10/2/2026, 2:07 pm EDT: WIRED has updated the story to elaborate on how the flaw could be exploited.