ChatGPT macOS App Flaw: Patched Local Bug Exposed Chats

Introduction

OpenAI has fixed a flaw in its ChatGPT app for macOS that was found by Patrick Wardle of the Objective-See Foundation. WIRED reported the story on October 2, 2026. OpenAI's changelog, dated September 25, 2026, lists a "macOS security update 26.924" with the line "Fixed CVE-2026-100754 on macOS in version 26.924.20706, with thanks to Patrick Wardle, Objective-See Foundation." The key qualifier comes first: according to WIRED, the flaw could only be exploited by an attacker who already had malware installed on the target machine. It was not a remote attack. The bug is patched, and users on version 26.924.20706 or later have the fix.

Feature Overview

How the app protects itself. WIRED explains that the ChatGPT macOS app has multiple components that communicate with each other by checking digital signatures. The point is to confirm that both processes are OpenAI components and not outside software making a request. The design goes further, requiring signature checks at three layers of removal from the request, so that malicious software cannot use an OpenAI component as a proxy to make a seemingly trusted request.

Where the check broke down. Objective-See researchers found a trusted component, a script interpreter, that would accept an untrusted script, or list of commands to run. That script could then be delivered into the main ChatGPT process. Wardle told WIRED that the checks also cover the parent and grandparent of the process, "but the malicious script just spawns the script interpreter three times and then makes the request so it will satisfy the requirements." In other words, the ancestry checks verified who the callers were, not whether the content they relayed was trustworthy.

Effort required. Wardle called the vulnerability "insanely trivial" to exploit, and said his proof of concept needed about a dozen lines of code. That describes the exploit code once malware is already on the machine; it does not change the local-access precondition.

What an attacker could reach. WIRED reports the flaw could be used to access ChatGPT chat logs. It could also get ChatGPT to run commands for the attacker, such as accessing a browser or other sensitive applications, with the requests appearing as legitimate instructions issued by the OpenAI software.

Usability Analysis

For ordinary users the practical advice is short. Check that your ChatGPT macOS app is on version 26.924.20706 or later, the version OpenAI's changelog names as containing the fix, and update if it is not.

The incident matters beyond a single app because desktop AI assistants hold two kinds of valuable material: conversation history and the ability to act. Wardle put it this way: "Agents need a lot of access to do their job. They are like the building manager who has access to the keys to all the rooms. So if they can be corrupted or subverted, that's super problematic."

Defenders and enterprise administrators can draw a narrower lesson. A signature check proves the identity of a process, not the intent of the data it forwards. When an app has a trusted component that executes whatever it is handed, any local process that can reach that component can borrow its credibility.

What this does not mean. Nothing in the WIRED report suggests a way to trigger the flaw from a website, a message or the network. The attacker model is a program already running on the Mac, which is why the proof of concept can be so short: the hard part, getting code onto the machine, is assumed to have happened. The harm lies in what that program could then do through ChatGPT, namely read stored conversations and have the app act on its behalf.

Pros and Cons

On the positive side, the flaw was reported, fixed and credited in a public changelog entry, and OpenAI gave WIRED an on-record statement. The signature-based design also reflects deliberate effort, with checks extending to the parent and grandparent of a process. On the negative side, the checks were defeated by repeating a single trusted component, and the bug could expose chat history. OpenAI's own statement to WIRED, from spokesperson Shane Bauer, reads: "We continue to evolve our security practices, but recognize a need to move faster."

Outlook

This is not the end of the story. WIRED reports that Wardle recently found a now-patched flaw in the dictation feature of Meta's Muse AI assistant, where a mishandled authentication token could be exploited by a local attacker. He also says he has submitted a new finding to OpenAI about the integration between ChatGPT and OpenAI's new always-on Dots assistant, which OpenAI is reviewing. He will present analysis of a number of AI macOS application bugs at Objective by the Sea, an Apple-focused security conference in November. His broader warning to WIRED: "the more features, the broader the attack surface."

Conclusion

The ChatGPT macOS flaw is a contained, local, patched issue, but it illustrates how trust chains built on process identity can be gamed. Mac users of ChatGPT should confirm they run version 26.924.20706 or later; security teams should note that on-device AI agents are now worth auditing like any privileged app.

Editor's Verdict

ChatGPT macOS App Flaw: Patched Local Bug Exposed Chats is a workable proposition that fills a clear gap, even if it doesn't fundamentally change the landscape.

The strongest case for paying attention: the flaw is fixed and credited in a public changelog entry. That alone raises the bar for what readers should expect in this space. Reinforcing that, exploitation required malware already on the machine, so it was not a remote attack — practical value rather than just headline appeal. The broader signal worth registering is straightforward: local-access requirements limit the attack surface but do not remove the risk, because malware that is already present can borrow the app's trust. On the other side of the ledger, one constraint is real rather than a marketing footnote: the signature checks were defeated by a roughly dozen-line proof of concept. It should factor into any serious decision. Layered on top of that, the flaw could expose chat logs and let an attacker issue commands that look legitimate — which narrows the set of teams for whom this is an obvious yes.

For ChatGPT power users, OpenAI API customers, and enterprise teams already running on the OpenAI stack, the smart move is to track its trajectory and revisit once the rough edges are filed down. For everyone else, the safer posture is to monitor coverage and revisit once the use cases that matter to your team are demonstrated in the wild.