OpenAI identifies security issue involving third-party tool, says user data was not accessed

OpenAI disclosed Friday identification of security issue involving third-party developer tool Axios, confirming no evidence user data accessed, systems compromised or intellectual property altered. The ChatGPT maker detected compromise within widely-used library as part of broader software supply chain attack attributed to North Korea-linked actors on March 31. Company immediately updated security certifications requiring all macOS users update OpenAI desktop apps to latest versions preventing fake app distribution.

Axios vulnerability stemmed from GitHub Actions workflow misconfiguration enabling malicious code injection during macOS application notarization process. OpenAI suspended legacy certification workflows while notifying Apple of supply chain breach. Passwords, OpenAI API keys and core platform data remained unaffected alongside ChatGPT conversational histories.

Effective May 8, older macOS desktop app versions cease receiving updates or support, potentially rendering them non-functional. Company emphasized incident limited to developer tooling absent direct platform exposure.

Disclosure follows December Mixpanel analytics breach exposing API user names, emails and browser data absent ChatGPT account compromise. OpenAI discontinued Mixpanel integration post-incident while notifying affected enterprise customers.

Security lapse arrives amid $100 billion ad revenue projections, $500 billion valuation talks and EU Digital Services Act designation imposing systemic risk audits. Recent Anthropic, Mercor supply chain attacks underscore frontier model ecosystem vulnerabilities against nation-state tooling.

OpenAI maintains 2.75 billion weekly active users with enterprise API powering workflow automation across Fortune 500. Company accelerated Trusted Platform Module integration alongside zero-trust architecture upgrades post-AWS $50 billion infusion.

macOS represents 12% desktop ChatGPT traffic trailing Windows 62% and web 26%. Affected notarization flaw could enable malware masquerading as legitimate OpenAI applications during downloads.

No customer notifications required under incident scope while enterprise security teams monitor for anomalous Axios library versions. OpenAI chief security officer confirmed root cause remediation alongside enhanced third-party vetting protocols.