The flaw OpenAI fixed in ChatGPT’s Mac app this autumn was not exotic. Objective-See Foundation researchers needed only about a dozen lines of code to show they could take over the assistant on a victim’s machine, reading stored chats and reaching browser sessions it was linked to.
The company logged the patch on September 25. “We continue to evolve our security practices, but recognize a need to move faster,” spokesperson Shane Bauer told Wired.
What made the bug biting was the trust the app places in its own parts. ChatGPT’s macOS build cross-checks digital signatures so only genuine OpenAI components trade requests, verifying even a process two levels removed. The researchers found a script interpreter that accepted outside scripts regardless, then had it spawn three times so the signature check was satisfied.
Patrick Wardle, a longtime macOS researcher at the foundation, compared capable agents to a building manager holding keys to every room. Once such a component turns, unprivileged code inherits its reach, and the assistant will follow instructions that look like its own.
November brings a fuller airing: Wardle is booked to speak at Objective by the Sea, an Apple-focused security conference. He has also logged a patched flaw in the dictation feature of Meta’s Muse assistant and handed OpenAI a new report on how ChatGPT talks to its Dots agents. Security, in his view, still trails feature work.
