OpenAI Sets June 12 Update Deadline for macOS Apps After Supply-Chain Attack
Summary
OpenAI says a supply-chain attack affected its signing certificates and led to limited credential exfiltration from internal repositories; it found no evidence of customer-data theft. macOS users must update by June 12. TanStack packages were also affected.
Key points
- OpenAI said two employee devices were affected and limited credential material was exfiltrated from internal repositories; the company said no other code or information was affected.
- OpenAI reported no evidence that customer data was stolen or that existing software installations were compromised.
- macOS users must update OpenAI apps by June 12 to continue receiving updates and support; users of the iOS and Windows apps do not need to act.
- OpenAI said it isolated affected systems, revoked user sessions, rotated credentials, and hired an incident-response firm to help investigate.
- The TanStack incident compromised 84 npm package artifacts with credential-stealing malware; the article says the malware could target packages maintained by victims and republish them.
- Mistral AI confirmed a temporary compromise through a third-party supply-chain attack and said attackers accessed only certain non-core code repositories. TeamPCP allegedly offered stolen Mistral repositories for sale.
Article Details
- Victim Organization
- OpenAI
- Incident Type
- Software supply-chain attack affecting OpenAI signing certificates and internal source code repositories
- Data Types Exposed
- Credential material from internal source code repositories
- Operational Impact
- Two employee devices were impacted. OpenAI isolated the systems, revoked user sessions, rotated credentials, and investigated activity. macOS users were asked to update their OpenAI apps by June 12 to continue receiving updates and support; the article reports no evidence that customer data was stolen or existing software installations were compromised.
- Claim Status
- confirmed