OpenAI suffers supply chain attack leaking signing certificates, macOS applications will be forced to update next month

robot
Abstract generation in progress
ME News Report, May 15 (UTC+8), according to Beating Monitoring, OpenAI confirmed that its internal environment was targeted by a malicious NPM package supply chain attack against TanStack, with two employees' devices infected.
Although user data and core code were not affected, hackers stole access credentials to some internal code repositories, including code signing certificates used for iOS, macOS, and Windows products.
To prevent hackers from using stolen certificates to release counterfeit applications, OpenAI announced a defensive certificate rotation and set a hard update deadline on the macOS platform.
All macOS users using ChatGPT desktop, Codex, or Atlas Browser must upgrade to the latest version before June 12, 2026, after which old certificates will be completely revoked, and security mechanisms will block the launch and fresh installation of outdated applications.
This attack coincidentally occurred during OpenAI’s internal security upgrade window.
The company admitted that it had already been deploying stricter code package interception policies, but the two infected employee devices had not yet synchronized the latest configurations, allowing malicious components to exploit the gap.
In terms of aftermath, since Apple’s macOS system mechanism defaults to intercept applications forged with stolen certificates, OpenAI chose to leave nearly a month for updates to avoid immediate revocation of certificates that could cause widespread disconnection for old users.
Currently, iOS and Windows clients are unaffected, and user account passwords, API keys, and other core data have been confirmed secure.
(Source: BlockBeats)
View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • 9
  • 2
  • Share
Comment
Add a comment
Add a comment
QuietAlphaClerk
· 11h ago
Factories of this caliber being hit by supply chain attacks, small teams should be trembling even more.
View OriginalReply0
FlowingColorfulInkHeart
· 13h ago
The license won't be revoked until June 2026; the grace period is quite generous, but don't wait until the last week.
View OriginalReply0
NonceNinja
· 14h ago
Supply chain attacks are unstoppable; the NPM ecosystem has to take the blame.
View OriginalReply0
SeeingTheChainThroughTheFog
· 14h ago
iOS and Windows users are temporarily safe; macOS has become the main focus.
View OriginalReply0
BlocktimeBarista
· 15h ago
Two devices have obtained internal credentials, the attacker has some leverage.
View OriginalReply0
0xLateDinner
· 15h ago
Certificate rotation + forced upgrade, OpenAI's response this time is quite quick.
View OriginalReply0
WalletEarlyAccessAlarm
· 15h ago
TanStack gets caught in the crossfire; developers really need to be cautious when using third-party dependencies.
View OriginalReply0
ContrarianIndicatorMyself
· 15h ago
Losing core data isn't too bad, but having the code signing certificate stolen is still pretty upsetting.
View OriginalReply0
GateUser-5578154d
· 15h ago
macOS users, remember the deadline of 2026-06-12—if the certificate gets revoked, you won’t be able to open the app.
View OriginalReply0
View More
  • Pinned