12 Lines of Code Could Hijack ChatGPT’s Mac App

A patched vulnerability in OpenAI’s ChatGPT app for macOS could have let locally running malicious code access chat logs and issue commands through the app, according to WIRED. Researchers at the Objective-See Foundation found that an attacker could route untrusted instructions through a trusted script interpreter, making the requests appear to come from OpenAI software.

Patrick Wardle, an Objective-See software analyst and longtime macOS security researcher, described the vulnerability as “insanely trivial” to exploit. He told WIRED that his proof of concept required about a dozen lines of code.

OpenAI publicly acknowledged the flaw and its fix in a system change log on September 25, 2026, WIRED reported. OpenAI spokesperson Shane Bauer told the publication: “We continue to evolve our security practices, but recognize a need to move faster.”

The trust check that failed

The ChatGPT macOS app uses multiple components that communicate with one another. Digital-signature checks are intended to verify that the processes involved belong to OpenAI rather than to outside software.

The design did not check only the process making a request. It also validated the process’s parent and grandparent, creating three layers of signature checks intended to prevent malicious software from using a legitimate OpenAI component as a proxy.

Objective-See found that one trusted component, a script interpreter, would accept an untrusted script or list of commands. Wardle said a malicious script could spawn that interpreter three times and then make its request, causing the process, parent and grandparent checks to accept the chain.

That exposed a basic weakness in ancestry-based authentication: verifying which programs launched one another does not establish that the instructions flowing through them are trustworthy. A signed interpreter remains dangerous if untrusted local code can control what it sends to a privileged process.

Chat logs and connected applications were exposed

WIRED reported that exploiting the flaw could effectively take over ChatGPT on the victim’s computer. An attacker could access chat logs and other information stored by the app, along with connected resources such as browser sessions.

Wardle also demonstrated that the vulnerability could make ChatGPT run commands for an attacker, including commands that accessed a browser or other sensitive applications. Those requests would appear to be legitimate instructions issued by OpenAI’s software.

“Agents need a lot of access to do their job,” Wardle told WIRED, comparing an agent to a building manager holding keys to every room. If such an app is subverted, he said, unprivileged code could potentially inherit access to the systems and data the agent controls.

Wardle is scheduled to present analysis of multiple macOS AI application bugs at the Apple-focused Objective by the Sea security conference in November 2026.

The problem extends beyond ChatGPT

Wardle also recently found a now-patched vulnerability in the dictation feature of Meta’s Muse AI assistant, WIRED reported. A local attacker could have obtained a mishandled authentication token and used it to access user data.

He has separately submitted a vulnerability report to OpenAI concerning the integration between ChatGPT and the company’s always-on Dots AI assistant. WIRED said OpenAI was reviewing that report; the publication did not disclose its technical details or say that the issue had been confirmed.

The findings do not show that every desktop AI assistant has the same vulnerability. They do illustrate how integrations, interpreters and authentication tokens can each create additional paths from untrusted local code to sensitive capabilities.

AI Mastery analysis

This was an application-architecture failure, not a failure of ChatGPT’s underlying model. The vulnerable boundary existed between local processes: the app treated a signed interpreter and its process ancestry as evidence that a request was legitimate, even though untrusted code could supply the interpreter’s instructions.

Signature validation can establish the identity of executable components, but it cannot determine whether the data passing through those components is safe. Desktop agents therefore need isolation, strict authorization for each capability and controls over untrusted input—not only checks that participating binaries carry the expected signature. That distinction reinforces our earlier analysis that infrastructure isolation, not model guardrails, is the core AI security layer.

The risk grows as desktop assistants connect to browsers, local data and other applications. A compromised assistant can become a bridge into every resource users have authorized it to reach. The roughly dozen-line proof of concept is a warning that deep access must be matched by boundaries designed for hostile local input.

Sources

• Primary: Romance scams: AI-enabled romance scam workflows | OpenAI
• Reported by: Wired AI: A Flaw in ChatGPT’s Mac App Could Have Let Hackers Grab Sensitive Data