A flaw in ChatGPT’s Mac application could have allowed malware already running on a computer to take control of the app and reach sensitive information, according to an October 2 WIRED report. OpenAI acknowledged the issue and recorded a fix in its September 25 public changelog. The finding is therefore about a repaired vulnerability, not evidence that the described route remains open. Researchers at the Objective-See Foundation say it exposed a weakness in how the application decided which software components deserved its trust.
Existing malware was a prerequisite for the attack
The scenario described by WIRED began with an attacker having malware installed locally. It was not presented as an attack that anyone could launch remotely simply by sending a ChatGPT message. That distinction matters because the flaw extended an existing compromise: it offered malicious software a way to operate through another application’s capabilities and access, rather than supplying the initial route onto the computer.
According to the researchers, taking over ChatGPT could expose chat histories and data available through browser connections. The app could also issue commands to a browser or other sensitive applications. The reported risk was therefore broader than changing a chatbot’s answer. An attacker could potentially use the app as a trusted intermediary for actions or information that would otherwise sit outside the malicious component’s direct reach.
Patrick Wardle of Objective-See described his demonstration as straightforward and said it required only around a dozen lines of code. That is his assessment of the proof of concept, not evidence of widespread exploitation. WIRED’s account did not establish how many users were affected by actual attacks. It also did not turn the local-malware prerequisite into a remote-access claim. Keeping those boundaries explicit prevents the potential impact from being mistaken for a documented breach.
A trusted interpreter weakened the ancestry check
The application used digital signatures and process relationships to distinguish trusted components from outside code. As described in the report, its checks considered the process making a request, that process’s parent and its grandparent. The intention was to establish that requests originated within an acceptable chain of software components before the main ChatGPT process acted on them.
The researchers found that a trusted script interpreter could accept an untrusted script. Their method arranged repeated interpreter launches so that the process ancestry satisfied the application’s checks, even though the initiating instructions were malicious. The important weakness was not that digital signatures had ceased to work. It was that a component recognized as trusted could carry instructions whose origin did not deserve the same trust.
Once that distinction was lost, commands could pass to the main application process. The report illustrates why examining a limited number of ancestors is different from establishing the provenance of every instruction. A legitimate interpreter and an attacker-controlled script can coexist in the same execution chain. That explanation describes the security boundary at issue without assuming the attack bypassed every other protection on the Mac or required no prior compromise.
The fix closes this finding, while other work remains separate
OpenAI spokesperson Shane Bauer told WIRED that evolving security practices need to move faster. The company had acknowledged and patched the reported vulnerability before the article appeared. Wardle plans to discuss the research at a conference in November. Those dates separate the discovery and repair from its later public presentation; they do not indicate that the patch is awaiting the conference.
WIRED also mentioned Wardle’s work on a different, already patched issue involving Muse’s dictation token. That finding concerned another application and should not be collapsed into the ChatGPT vulnerability. Likewise, a report concerning ChatGPT’s Dots integration was under OpenAI’s review. The article did not present that separate submission as a confirmed defect or a completed security assessment.
Wardle argues that adding features expands the attack surface and that security can become an afterthought. His broader criticism is an interpretation informed by his research, rather than a measurement of all ChatGPT integrations. The concrete result here is narrower and clearer: a local attacker could exploit an overly trusting component chain, OpenAI accepted the finding, and the company issued a fix. The report demonstrates how application trust can amplify malware’s reach without establishing that users’ data was actually stolen.
