OpenAI has identified a security issue related to a third-party developer library, Axios, and is working to protect the system used to verify its macOS apps as legitimate OpenAI software.

The company said in a press release that there is no evidence that its user data was accessed, that its ​systems or intellectual property were compromised, or that its software ​was altered.

OpenAI is updating its security certificates, which will require all macOS users to update their OpenAI apps to the latest versions. This will help protect users against someone attempting to distribute a fake app that appears to be from OpenAI.

On March 31st, 2026, Axios was compromised as part of a broader software supply chain attack.⁠ OpenAI said a GitHub Actions workflow used in its macOS app-signing process downloaded a malicious version of Axios. That workflow had access to the digital certificate used to verify that apps like ChatGPT Desktop and Codex genuinely come from OpenAI.

The company said that its analysis concluded that the signing certificate was likely not successfully exfiltrated by the malicious payload. However, it’s still treating the certificate as compromised.

Therefore, older versions of macOS desktop apps will no longer receive updates or support, and may not be functional as of May 8th.

In case of a successful compromise, malicious actors could use the certificate to sign their own code, making it seem like legitimate OpenAI software.

“We have stopped new software notarizations using the old certificate, so new software signed with the old certificate by an unauthorized third party would be blocked by default by macOS security protections unless a user explicitly bypasses them,” the press release said.

The company explained that the incident occurred due to a misconfiguration in the GitHub Actions workflow, which has since been resolved.

According to OpenAI, passwords and OpenAI API keys were not affected. The web versions of its software were also not affected – the incident only concerned OpenAI macOS apps.

---

Unlock more exclusive Cybernews content on YouTube.