ChatGPT for Mac Flaw Could Expose Chats and Let Attackers Issue Commands

A flaw in ChatGPT’s macOS app could have let malware on a user’s computer access the app’s chat logs and use its trusted processes to issue commands to other applications. OpenAI has patched the vulnerability, but the finding highlights a practical risk in desktop AI software: the permissions and system access that make an assistant useful can also make it a valuable target.

Researchers at the Objective-See Foundation found the bug. It did not give a remote attacker a way into a Mac on its own. An attacker first needed malware installed on the target computer. From there, the flaw could let that malware manipulate ChatGPT’s internal processes and make requests that appeared to come from OpenAI software.

How the app’s trust checks were bypassed

ChatGPT for macOS uses several components that communicate with one another. The app checks digital signatures to confirm that a process making a request belongs to OpenAI, rather than to outside software. It also checks processes further up the chain: the parent and grandparent of the process making the request. The layered checks are meant to prevent malicious software from using a trusted OpenAI component as a proxy.

Objective-See’s researchers found a gap in that design. A trusted script interpreter would accept commands from an untrusted script, which could then pass instructions into ChatGPT’s main process. The researchers showed that malware could repeatedly start the interpreter to satisfy the parent and grandparent checks before making its request. The checks were present, but this process arrangement made it possible to get around them.

Patrick Wardle, a software analyst at the Objective-See Foundation and a longtime macOS researcher, said his proof of concept needed only about a dozen lines of code. He described the exploit as “insanely trivial” to carry out once malware was already on the machine. That distinction matters: the flaw increased what an attacker could do after gaining a foothold, rather than providing the initial route onto a victim’s computer.

What an attacker could reach

The reported exposure included ChatGPT chat logs and other data stored by the app. The weakness could also let an attacker use ChatGPT to run commands, including requests to access a browser or other sensitive applications. Because those requests came through a trusted ChatGPT process, they could appear to originate from legitimate OpenAI software.

That kind of access raises a broader design question for desktop assistants. They may need to work with local files, browsers, or other applications to carry out user requests. Each connection can expand what the software can do, and what an attacker might be able to do if they find a way to control it. Wardle compared an AI agent with “the building manager who has access to the keys to all the rooms.” His point is about the consequences of compromising software with broad access: code that starts with limited privileges may gain a path to data and functions available to the assistant.

For developers, the issue is not simply whether an app checks signatures. The checks also need to hold when trusted components accept input from other processes, and when a chain of process launches can affect how those checks are evaluated. An interpreter that runs untrusted commands can become a route into a more privileged application, even if the application verifies the identity of the process making a request. This finding shows why testing the paths between components matters alongside checking each component’s identity.

Patch and wider concerns

OpenAI acknowledged the vulnerability and its fix in a system change log on September 25. Company spokesperson Shane Bauer said, “We continue to evolve our security practices, but recognize a need to move faster.” The source does not provide details about how many users were affected or whether anyone exploited the flaw. The described attack required malware to be present on a target Mac.

Wardle said he plans to present analysis of several bugs in AI applications for macOS at the Objective by the Sea security conference in November. He has also reported a separate, patched flaw in the dictation feature of Meta’s Muse AI assistant. That issue could have allowed a local attacker to obtain a mishandled authentication token and access user data. Wardle said he had submitted another finding to OpenAI concerning the connection between ChatGPT and its Dots assistant, which was under review at the time of the report.

The cases point to an expanding set of components and integrations that developers need to secure as AI assistants gain access to more tools. New features can add more paths between an assistant and a user’s data, so teams need to examine how those paths behave when input comes from untrusted software. For users, the immediate protection is the ChatGPT macOS patch; for app makers, the continuing challenge is to keep the trust granted to an assistant from becoming a shortcut for other code.