ChatGPT Mac client vulnerability could lead to data theft

The ChatGPT Mac client fixed a vulnerability that could bypass process signature verification. OpenAI released the fix on September 25 and thanked researcher Patrick Wardle in the changelog. The poster stated that the vulnerability is numbered CVE-2026-100754 and the fixed version is 26.924.20706. When communicating between internal components, the client verifies that the calling process is signed by OpenAI and traces up to the parent and grandparent processes. The researcher found that a script interpreter bundled with and trusted by ChatGPT can be nested to launch three levels deep, making the malicious code's process chain appear as trusted OpenAI components in all three upward checks, thus passing verification. The poster said the attack code is about a dozen lines, and once bypassed, it can read chat history and gain computer permissions using ChatGPT's identity. The post also cites the author's own earlier post, arguing that macOS is tightening Full Disk Access to prevent AI agents from reading files, emails, Messages, browsing history, configuration, and logs.

Researchers at the Objective-See Foundation discovered a fixed vulnerability in OpenAI's ChatGPT macOS client that could allow an attacker to take over the local ChatGPT, read all chat history and browser session data, and even have ChatGPT execute commands on their behalf as legitimate instructions. The app originally verified multiple components through digital signatures and required tracing back three parent processes, but a trusted script interpreter would accept untrusted scripts, and a malicious script only needed to spawn the script interpreter three times to satisfy the verification conditions. Researcher Patrick Wardle said the exploit was extremely simple, with a proof of concept requiring only about a dozen lines of code. OpenAI publicly confirmed the vulnerability and fix in its system changelog on September 25, and spokesperson Shane Bauer said the company would continue to improve its security practices but needed to act faster.