OpenAI Patches Critical ChatGPT Mac App Flaw That Allowed Deep System Access
OpenAI has patched a security vulnerability in the desktop macOS application of ChatGPT that could have permitted unauthorized actors to take control of the assistant on a victim's machine. Discovered by researchers at the Objective-See Foundation, the flaw exposed stored chat logs, browser sessions, and other sensitive user data while enabling attackers to execute commands disguised as legitimate software instructions.
The vulnerability stemmed from how the desktop application verified internal processes. The ChatGPT macOS app relies on multi-layer digital signature checks to ensure that communicating components originate from OpenAI and are not malicious software acting as a proxy. However, researchers identified that a trusted script interpreter component could be manipulated into accepting untrusted instructions by spawning the interpreter multiple times to bypass parental and grandparental signature verifications.
Exploitation Mechanism and Elevated Privileges
According to Objective-See Foundation software analyst Patrick Wardle, the exploit required only about a dozen lines of code and was trivial to execute. Because AI desktop assistants require extensive system permissions to function across daily workflows, compromising the application grants unprivileged code sweeping access to user systems. Wardle described AI agents as building managers possessing keys to every room, warning that subverting them creates severe security liabilities across enterprise environments.
According to iMasters, corporate security teams are requiring comprehensive audits and sandboxing of third-party AI desktop agents before authorizing local execution in enterprise environments. According to Source, iT leaders are worried that security controls are not keeping pace with threats to AI systems.
Beyond extracting personal and professional conversations, the flaw allowed attackers to direct ChatGPT to interact with web browsers and other sensitive applications. OpenAI acknowledged the security issue in its September 25 system change log. In a statement provided to media outlets, OpenAI spokesperson Shane Bauer noted that the company continues to evolve its security practices while acknowledging a broader need to move faster across the industry.
Broader Security Implications for Desktop AI Ecosystems
The incident highlights mounting security concerns as enterprises and individual users rapidly integrate generative artificial intelligence into daily productivity workflows. Unlike traditional software vulnerabilities that expose system files or databases, compromised AI applications function as honeypots capable of leaking extensive personal and business intelligence accumulated over months of conversation histories.
Security researchers emphasize that the rapid deployment of features across the AI sector frequently sidelines robust security protocols. Wardle disclosed that he has also identified vulnerabilities in competing products, including a patched authentication token flaw in Meta's Muse AI assistant dictation feature, and has submitted a new finding regarding ChatGPT integration with OpenAI's Dots assistant. He is scheduled to present broader findings on AI desktop application security at the upcoming Objective by the Sea conference.
According to AI to ROI, responsible disclosure timelines for desktop AI flaws typically see vendors deploying rapid hotfixes within days to prevent privilege escalation exploits. According to iMasters, platform review guidelines such as Apple App Store Guideline 2.5.2 restrict post-installation code execution, creating structural tensions with generative AI applications that dynamically compile and interpret code.
According to iMasters, wardle previously identified an authentication token leakage vulnerability in Meta's Muse macOS assistant dictation endpoint, which Meta patched shortly after disclosure. According to iMasters, for OpenAI macOS Security Patch, OpenAI pushed the production fix on September 25, 2026, while a follow-up vulnerability submitted by Wardle regarding ChatGPT's integration with the Dots assistant remains under OpenAI evaluation.