OpenAI fixes ChatGPT for macOS flaw that could let local code misuse trusted access

OpenAI has fixed a security flaw in ChatGPT for macOS that researchers said could allow unprivileged code already running on a Mac to act through trusted components of the desktop application.

The company documented the fix for CVE-2026-100754 on 25 September 2026. OpenAI identified version 26.924.20706 as the fixed build and credited Patrick Wardle of the Objective-See Foundation. Neither OpenAI’s notice nor the reviewed WIRED report identifies a victim, confirmed data theft or exploitation in the wild.

Those limits matter. The available account does not describe a demonstrated standalone remote attack against any ChatGPT user. Instead, the reported path began with code already executing on the victim’s Mac without elevated privileges.

WIRED published a detailed account of the research on 2 October 2026, identifying Objective-See researchers as the discoverers and describing the possible consequences. The technical explanation and impact claims come from that reporting because OpenAI’s public changelog confirms the CVE and fixed build but provides little information about the underlying weakness.

A flaw in application trust checks

According to WIRED’s account of the Objective-See research, components of the ChatGPT macOS application used digital signatures and process ancestry to decide whether another process should be trusted. Process ancestry refers to the chain of processes from which a particular program or action originated.

Those checks were used to distinguish trusted OpenAI software from unrelated local code. However, WIRED reported that a trusted script interpreter could accept untrusted input in a way that defeated the checks. Local unprivileged code could consequently appear within a process chain accepted by the application and invoke capabilities associated with trusted ChatGPT components.

As described, this was a desktop application trust-boundary failure rather than prompt injection or a defect in the language model itself. The weakness concerned how local software components established trust and exercised access on macOS, not how ChatGPT interpreted a user’s natural-language prompt.

The local-code requirement narrows the threat model. It does not make the issue irrelevant: a local process with limited privileges could potentially use the ChatGPT application’s trusted position to reach data or application capabilities that the process could not access directly.

The reviewed reporting does not provide a complete account of the permissions, integrations or configuration required for every potential action. The practical reach could therefore differ between installations, and the evidence does not establish that browser sessions or other applications were reachable in every configuration.

Potential access is not confirmed theft

WIRED reported that successful exploitation could potentially expose ChatGPT chat logs. According to WIRED, Objective-See researchers also said the weakness could enable requests involving browser sessions or other sensitive applications while making the activity appear to originate from trusted OpenAI software.

That description establishes potential impact, not a confirmed compromise. Neither OpenAI’s notice nor the reviewed WIRED report identifies unauthorised access to a user’s data, exfiltration, an affected organisation or a malicious campaign. WIRED described a researcher-created proof of concept, rather than exploitation attributed to a threat actor.

The absence of publicly reported exploitation does not establish that no attempts occurred. OpenAI’s notice does not say whether the company observed attempted or successful exploitation through its telemetry. It also does not assign a severity or CVSS score to the vulnerability.

OpenAI has not published a complete affected-version range in the reviewed notice. Version 26.924.20706 is confirmed as containing the fix, but that does not establish that every earlier ChatGPT for macOS release was vulnerable. The same evidence does not establish that the Windows application, web service, Codex or another OpenAI product was affected.

Users should verify the fixed build

Mac users and administrators should verify that their installed ChatGPT application includes the fix OpenAI documented in version 26.924.20706. OpenAI described the relevant release as macOS security update 26.924, but the complete verified build number is 26.924.20706.

The available sources do not document whether the update was installed automatically for all users or provide adoption figures. Managed Mac environments may therefore need to confirm the full installed build rather than rely only on the release label.

The update guidance applies in Australia as elsewhere. The reviewed sources identify no Australia-specific exploitation, victims or data exposure. Australian users and organisations should read this as guidance about a patched vulnerability, not evidence that a local incident occurred.

Several questions remain open after the patch. OpenAI has not specified the earliest affected build, the full vulnerable range, the precise permissions required to reach each category of data, or whether any users were affected. A fuller vendor advisory or primary Objective-See publication could clarify those points.

The case also illustrates why desktop AI security extends beyond the handling of prompts. An application may hold sensitive conversations while interacting with other software, making trust decisions between its local components security-relevant. For CVE-2026-100754, the supported next step is concrete: verify the full macOS build number without treating the flaw as evidence of theft or remote compromise.

Process ancestry and local trust decisions help explain this desktop application’s security boundary, while the language model itself was not at issue. Follow those operating-system concepts into The Hack Academy’s online cybersecurity training programme, with self-paced study in Linux and cybersecurity fundamentals, combining theory with practical exercises.