OpenAI Security Issue with Axios

OpenAI identified a security issue stemming from a compromised third-party developer tool, Axios (JavaScript library), which was part of a broader software supply chain attack believed to be linked to North Korea. This attack led to a malicious version of Axios (JavaScript library) being downloaded and executed via a misconfigured Microsoft — GitHub Actions workflow used by OpenAI. While the incident gave access to certificate and notarization materials for macOS applications like ChatGPT Desktop, Codex, and Atlas, OpenAI found no evidence that user data, systems, or intellectual property were compromised, and the signing certificate was likely not exfiltrated. OpenAI is updating its security certifications and requiring all macOS users to update their apps to the latest versions by May 8 to prevent the distribution of fake applications. The company has addressed the root cause, a misconfiguration in the Microsoft — GitHub Actions workflow, and confirmed that passwords and OpenAI API keys were unaffected.