Patched ChatGPT Mac App Flaw Could Have Exposed Chat Logs and System Access to Attackers
Researchers found the macOS app’s three-layer signature check could be bypassed by spawning a trusted script interpreter three times, with a proof of concept requiring about a dozen lines of code. OpenAI confirmed a fix on September 25, 2026.
A now-patched vulnerability in the macOS version of OpenAI’s ChatGPT app could have allowed attackers to take over the application and access a user’s chat logs, browser sessions, and other sensitive data stored by the app, according to researchers at the Objective-See Foundation who discovered the flaw.
OpenAI acknowledged the security flaw and its fix in a system change log entry dated September 25, 2026. “We continue to evolve our security practices, but recognize a need to move faster,” OpenAI spokesperson Shane Bauer said in a statement to WIRED.
The ChatGPT macOS app is designed to verify the digital signatures of its internal components before they communicate with each other — a three-layer check intended to prevent malicious outside software from impersonating trusted OpenAI processes. Researchers found, however, that a trusted script interpreter within the app would accept untrusted scripts and could be manipulated to deliver those scripts into the main ChatGPT process. By spawning the interpreter three times, a malicious script could satisfy all three layers of the signature check.
Objective-See Foundation software analyst Patrick Wardle described the vulnerability as “insanely trivial” to exploit, noting that a working proof of concept required only about a dozen lines of code. Beyond accessing chat logs, the flaw could have been used to direct ChatGPT to run commands on behalf of an attacker — such as accessing a browser or other applications — with those requests appearing as legitimate instructions from OpenAI software.
The case highlights the broad system access that AI applications require to function. “Agents need a lot of access to do their job,” Wardle said. “They are like the building manager who has access to the keys to all the rooms. So if they can be corrupted or subverted, that’s super problematic.” As AI apps become more widely installed, this could make them increasingly attractive targets for attackers looking to exploit that elevated level of trust.