IMAGE: REUTERS

NEXT STEP DESK

OpenAI is requiring all macOS users to update their desktop applications after a security issue involving a widely used third‑party developer library called Axios, the company has announced. The incident was part of a broader software supply chain attack reported on March 31, 2026. A GitHub Actions workflow used in OpenAI’s macOS app‑signing process downloaded and executed a malicious version of Axios. OpenAI says the workflow had access to certificates used to sign macOS applications, including ChatGPT Desktop, Codex, Codex‑cli and Atlas.

OpenAI said its analysis found that the signing certificate was “likely not successfully exfiltrated” by the malicious payload due to timing and other factors. However, the company says it is treating the certificate as compromised and is revoking and rotating it. The company stated that it has found no evidence that user data was accessed, that its systems or intellectual property were compromised, or that its software was altered.