AI Risk Wire

Cases › security breach › LR-2026-0797

ChatGPT macOS app vulnerability exposed conversations, since fixed

Preliminary Why: 1 report: ForkLog · subject to change · 1 independent report

Status: fix reported

Severity moderate
Reported 2 Oct 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity moderate: test met: user data of others touched (conversation logs), with a bounded scope stated (limited to local ChatGPT data and resources the app already had authorized access)

The system was the ChatGPT app for macOS, an AI assistant that holds conversations and can reach connected resources. Researchers found that unprivileged code running on a Mac could masquerade its commands as requests from trusted OpenAI components. The app's signature check extended to parent and grandparent processes, and a script interpreter in the trusted chain could run untrusted code. A malicious script could activate that interpreter three times, after which the app treated the request as trusted. The flaw was identified by researchers from the Objective-See Foundation. Reach was limited to local ChatGPT data and resources the app already had authorized access. The issue was fixed in app version 26.924.20706 and assigned CVE-2026-100754.

What happened

1 · What it was doingThe ChatGPT Mac app gives desktop access to an AI assistant and processes many conversations containing personal and professional information.
2 · What went wrongUnprivileged code on a Mac could masquerade its commands as requests from trusted OpenAI components, potentially reaching conversations, data and app integrations.
3 · How it was caughtResearchers from the Objective-See Foundation identified the vulnerability.

What was done

Fix reported

“Fix included in app version 26.924.20706”

Risks

AI system attacked or breached
Primary23 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Vulnerability scanning of AI components · Adversarial testing before deployment · Short-lived, scoped credentials · Live behaviour monitoring · AI incident response plan · Segmentation of agent components · Encryption of stored data

Infrastructure / target

Known flaws patched · Intrusion and endpoint detection · Inventory of exposed services

Evidence

No source states: what it reached or did, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 3 items from the primary sources

What happened, in order

Not dated in the sources:

  • Researchers privately reported the flaw to OpenAI before going public.
  • The patch was included in app version 26.924.20706.
  • Developers fixed the issue and disclosed the details, according to WIRED.
Show every field, with its source and grade

The AI system

What it was for
native desktop access to its popular AI assistant
C one secondary source states it

What happened

Earliest source we hold
2026-10-02
D inferred by us from the described behaviour, reason shown
Who caught it
an outside party
C one secondary source states it
Themes
CVE 2026 100754
C one secondary source states it
What was done
Fix included in app version 26.924.20706
C one secondary source states it
What went wrong
security breach
C one secondary source states it
primary risk
RK08
D inferred by us from the described behaviour, reason shown

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Why this severity
test met: user data of others touched (conversation logs), with a bounded scope stated (limited to local ChatGPT data and resources the app already had authorized access)
D inferred by us from the described behaviour, reason shown

Notes on gaps

The Hacktron AI intrusion and the 2024 unencrypted-conversations fix concern other incidents and are excluded.

LR-2026-0797 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON