OpenAI patches ChatGPT Mac flaw that could expose chats and connected applications
The AMW Read
A concrete trust-boundary bypass meaningfully updates OpenAI's application-security baseline and illustrates the deployment risks of assistants with access to connected tools.
OpenAI patches ChatGPT Mac flaw that could expose chats and connected applications
OpenAI acknowledged a security flaw and fix for its ChatGPT macOS app in its September 25 change log, according to WIRED. Objective-See Foundation researchers found that a trusted script interpreter could accept an untrusted script and pass it into the main ChatGPT process. Repeatedly spawning the interpreter bypassed checks intended to verify the requesting process and its parent processes. Exploitation could give an attacker access to stored chat logs and let them issue commands through ChatGPT to reach browsers or other sensitive applications. The report describes potential exposure, not a confirmed theft of user data.
For foundation-model companies expanding into agent software, this finding makes application security part of the competitive equation. The relevant industry force is deployment safety: access that makes an assistant useful also increases the consequences of compromised software. Here, checks on signed components failed to establish whether the commands they carried were trustworthy. Wardle also reported a separate vulnerability involving ChatGPT's integration with OpenAI's always-on Dots assistant; OpenAI is reviewing that report. That finding remains distinct from the patched Mac flaw.
Builders should test whether trusted helper processes can relay untrusted commands across application boundaries, including through chains of parent processes. The concrete lesson is to validate the origin and authority of a request rather than rely solely on the identity of the software delivering it. For investors assessing agent products, security review should examine connected-app permissions and patch responsiveness alongside feature breadth: a compromise of the assistant can potentially extend into the tools users authorize it to access.
