A malicious program installed on a Mac could take control of the ChatGPT application to read conversation history and access browser sessions. OpenAI fixed the vulnerability on September 25. A week later, Apple announced stricter controls on the permissions granted to macOS software. Patrick Wardle, founder of Objective-See, has been tracking Apple system vulnerabilities for years. Recently, he has focused on AI assistants installed on Mac, which users often grant access to their files and browsing data. "These agents require many access rights to function," Wardle explained to WIRED. "They are like the concierge of a building who has keys to all the rooms." If a hacker takes control of one of these tools, it can access all the "keys." In the ChatGPT application for Mac, a simple script interpreter was the weak link. The vulnerability allowed an attacker to bypass ChatGPT's security controls by launching the interpreter three times. OpenAI addressed this by splitting its macOS application into several signed components. Each request is verified through three levels of process to ensure no external software can hijack the application. However, the Objective-See team discovered that a list of unreliable commands could be injected into the main process of ChatGPT. At that stage, only the parent and grandparent processes were checked. "The malicious script simply launches the interpreter three times before making the request," Wardle explained. He created a proof of concept with just a dozen lines of code, calling the exploit "incredibly easy" to use. Once inside, an attacker could read all conversations stored by ChatGPT and instruct the application to open a browser or other sensitive programs. These requests were considered legitimate by macOS, so users would not receive any alerts. On September 25, OpenAI reported the vulnerability and its fix in the application’s update log, with version 26.924.20706. "We continue to evolve our security practices, but we recognize the need to move faster," said Shane Bauer, OpenAI’s spokesperson, to WIRED. The company did not mention any prior exploitation before the fix. OpenAI is still reviewing a new report by Patrick Wardle about the integration of ChatGPT with its AI agents, presented at the end of September. Earlier that month, Wardle had found a poorly protected authentication token in Meta’s Muse assistant, which could be exploited until Meta issued a fix. In 2024, ChatGPT conversations were stored in plain text on the disk before being encrypted. In the spring, OpenAI had to renew its macOS signature certificates after an attack on the Axios library. Despite these concerns, the company has not restricted its application to the sandbox Apple recommends for software handling private data. Many users have granted it full access to the disk to automate tasks. In August, OpenAI added the "Computer History" option, which records user actions and sends summaries to its servers. These summaries are stored in unencrypted Markdown files, readable by any program launched during the session. The raw data are stored for up to 48 hours on the machine before being processed by servers.