OpenAI Security Update for Mac Apps After Supply Chain Attack
OpenAI discovered that the Axios library used in its build process was compromised on 31 March 2026 in a supply chain attack, giving attackers access to code paths for signing macOS applications. The company found no evidence of actual data theft or certificate leakage but issued urgent updates and announced that unsupported versions would stop functioning after 8 May 2026.
What happened
On 31 March 2026, the Axios library, a third-party development tool used by OpenAI, was compromised in a supply chain attack believed to involve actors linked to North Korea. OpenAI's GitHub Actions workflow downloaded and executed a malicious version of the library, which gained access to sensitive code paths used for signing macOS applications including ChatGPT Desktop, Codex, Atlas, and Codex CLI.
OpenAI confirmed that investigations showed the digital certificates used to sign the applications were not actually leaked, limiting the severity of the incident. No evidence was found of user data breach, compromise of internal systems, or unauthorized modification of OpenAI's software.
Reported impact
OpenAI issued an urgent security update on 11 April 2026 and began reinforcing verification mechanisms for its macOS applications to prevent distribution of counterfeit versions. Starting 8 May 2026, older versions of OpenAI's desktop applications on macOS will no longer receive updates or support and may stop functioning.
Index analysis
The incident resulted from a workflow configuration flaw in GitHub Actions rather than a direct breach of OpenAI's systems. Passwords and API keys were not affected by the incident.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.