AI App Vulnerability: Hackers Could Seize ChatGPT Data

A critical vulnerability discovered in the macOS version of OpenAI's ChatGPT has been patched, addressing a significant security risk. Researchers from the Objective-See Foundation identified a flaw that could have allowed attackers to take over the application on a user's computer.

This exploit could have granted unauthorized access to all chat logs and sensitive data stored within the ChatGPT app. The vulnerability also posed a risk of enabling attackers to execute commands, potentially controlling other applications like browsers. The exploit's simplicity, requiring only a few lines of code, underscores the ease with which such vulnerabilities can be leveraged.

OpenAI publicly confirmed the fix on September 25, acknowledging the need to accelerate security improvements. The flaw exploited a weakness in how the app's components verified digital signatures, a crucial security measure designed to prevent malicious software from hijacking trusted processes.

This incident highlights a broader concern raised by security experts: as AI companies prioritize feature development, security often lags behind, creating a larger attack surface. Similar vulnerabilities have been found in other AI applications, suggesting a pattern of security being treated as an afterthought.