Researchers found a security flaw in the ChatGPT app for macOS
A vulnerability in the software could have allowed attackers to bypass security checks and access sensitive user data.
OpenAI recently fixed a vulnerability within its ChatGPT application for macOS. The flaw allowed unauthorized code to mimic legitimate requests, potentially granting an attacker full access to chat history and browser data.
The issue was identified by the Objective-See Foundation. Researchers discovered that the app relied on digital signature checks to verify software processes, but these safeguards were bypassed by tricking the system's script interpreter.
They are like the building manager who has access to the keys to all the rooms.
By launching a specific script three times, an attacker could satisfy the app's internal security requirements. This simple method allowed the malicious code to pose as a trusted component, giving it control over the application.
Patrick Wardle of the Objective-See Foundation noted that modern AI software often requires broad access to function. This necessity turns these applications into prime targets for exploitation.
"They are like the building manager who has access to the keys to all the rooms," Wardle explained.
OpenAI acknowledged the report and implemented a fix on September 25. The company stated it is working to improve its security development lifecycle.
Are you confident that the software on your computer is truly checking who is knocking on the door before letting them in?
This report is based on the analysis of a specific security vulnerability in the ChatGPT macOS desktop application. The source does not provide evidence that this exploit was used in the wild against individual users prior to the patch.
Source: WIRED: Artificial Intelligence