The Pulse
ChatGPT’s Mac App Flaw Let Local Code Reach Chats and Browser Sessions
OpenAI patched a macOS ChatGPT vulnerability that could let malware already on a Mac reach the app’s chat logs and interact with browser sessions. Researcher Patrick Wardle said the proof of concept took about a dozen lines of code.
AI.info Team · Written with AI ·
OpenAI’s macOS ChatGPT app checked digital signatures at several levels to keep outside software from impersonating trusted components. Researchers at the Objective-See Foundation found a way around those checks: a script interpreter the app trusted could be used to pass an untrusted script into ChatGPT’s main process. According to WIRED, only an attacker with malware already installed on the Mac could exploit it. OpenAI patched the flaw, but the finding shows how an app’s access to users’ data can become a liability when its internal safeguards fail.
Three checks, one route around them
The app’s components verify digital signatures when they communicate, according to WIRED’s report. The checks also examine the requesting process’s parent and grandparent, adding distance between an outside program and the ChatGPT process it might try to influence. Objective-See researchers found that an attacker could make the script interpreter spawn itself three times, satisfying those ancestry checks before making a request.
With that foothold, the route could let an attacker take over ChatGPT on a victim’s Mac and access chat logs and other data stored by the app. It could also be used to make ChatGPT issue commands that access a browser or other sensitive applications, with the requests appearing to come from legitimate OpenAI software. The report describes a potential attack; it does not say attackers used the flaw against victims.
“Agents need a lot of access to do their job,” Wardle told WIRED. “They are like the building manager who has access to the keys to all the rooms. So if they can be corrupted or subverted, that’s super problematic.”
Patrick Wardle, software analyst and longtime macOS researcher, Objective-See Foundation
A dozen lines to reach the main process
Wardle told WIRED that his proof of concept needed about a dozen lines of code. He described the vulnerability as “insanely trivial” to exploit, though WIRED notes it required malware already on the machine. The risk did not depend on an attacker breaking the signature checks directly; the weakness lay in how the trusted interpreter could be turned into a path for untrusted instructions.
OpenAI’s changelog lists a macOS security update dated September 25, 2026, and says version 26.924.20706 fixed CVE-2026-100754, crediting Wardle. As of October 3, no record for that CVE number had been published on cve.org or in the US National Vulnerability Database. OpenAI spokesperson Shane Bauer told WIRED the company continues to update its security practices but recognizes a need to move faster. The changelog confirms the fix; it does not describe the vulnerability’s mechanics.
The patch addresses one flaw, not the access question
ChatGPT’s local access is part of what makes the desktop app useful: its components can work across the system and interact with other applications. That same access gives attackers a valuable target if they can redirect or subvert a trusted component. Wardle’s analogy points to the security trade-off: a tool with broad permissions can expose more than its own conversation window when its internal trust boundaries break.
Wardle plans to present analysis of several macOS AI-app bugs at the Objective by the Sea security conference in November. He also told WIRED he had submitted a separate vulnerability report to OpenAI involving ChatGPT’s integration with its Dots assistant; OpenAI was reviewing that report at the time of publication. The September 25 entry, which WIRED links to, is filed under the changelog’s “ChatGPT desktop app” updates; its text names macOS but not the vulnerable component.