A Flaw in ChatGPT’s Mac App Could Have Let Hackers Grab Sensitive Data
wired ·
A recently patched vulnerability in the macOS version of OpenAI's ChatGPT app could have allowed attackers to seize control of the software and access sensitive user data. Discovered by researchers at the Objective-See Foundation, the flaw exploited a trusted script interpreter to bypass security checks that verify digital signatures across multiple process layers. This exploit enabled unauthorized access to chat logs, browser sessions, and other interconnected data stored on the victim's computer. Patrick Wardle, a software analyst at Objective-See, described the vulnerability as trivial to exploit, requiring only a dozen lines of code for a proof of concept. The incident highlights the significant risks associated with granting AI agents deep system access and trust to function effectively. OpenAI acknowledged the issue and implemented a fix in its September 25 system change log, while emphasizing the need to accelerate security practices. Wardle noted that AI companies often prioritize feature development over robust security measures, thereby expanding their attack surfaces.
wired