PSA: A security breach means you must update the ChatGPT Mac app [U]

All users of the ChatGPT desktop application on macOS must accept a forced update by June 12, 2026, following a security breach that compromised two OpenAI employee devices as part of a broader software supply chain attack.

Supply Chain Attack Targets Open-Source Library

On May 11, 2026, the widely used open-source library TanStack was compromised in an attack designated Mini Shai-Hulud. OpenAI confirmed that two corporate employee devices were impacted, triggering an immediate investigation and containment response.

The company engaged a third-party digital forensics and incident response firm to assess the damage. OpenAI reported that the malware exhibited behavior consistent with public descriptions, including unauthorized access and credential-focused exfiltration from a limited subset of internal source code repositories accessible to the two affected employees.

Certificate Revocation Forces Mandatory Update

The compromised code included the ability to sign certificates for OpenAI products, creating a critical vector for potential abuse. To mitigate this risk, OpenAI is revoking existing certificates and blocking the launch of any app signed with the previous certificate.

This forces the macOS app to update. The company stated that additional guidance will be provided to Mac users, though no action is required for iOS or Windows applications. OpenAI emphasized that it has found no evidence that user data was accessed or that its own core systems were compromised.

Minimal User Action Required

Users do not need to take any immediate action beyond accepting the update prompt when it appears. The forced update will roll out between now and June 12, and OpenAI is emailing users to remind them to accept the update when offered.

The company stressed that only limited credential material was successfully exfiltrated from the affected repositories, and no other information or code was impacted.

What This Means for Enterprise Security

This incident underscores the growing risk of supply chain attacks targeting open-source dependencies, even for organizations with mature security postures. For enterprise users, it reinforces the necessity of maintaining rigorous patch management protocols and monitoring for forced updates as a critical security measure. The broader implication is clear: as attackers increasingly target trusted third-party libraries, the speed and discipline of response become the defining factors in limiting exposure.

— Originally reported by 9to5Mac. Adapted and republished with editorial context for MacThreat.