The Bottom Line: OpenAI revoked macOS code signing certificates following a supply-chain attack on two employee devices and mandates immediate app updates by June 12, 2026.
Two OpenAI employee workstations were compromised by the Mini-Shai-Hulud supply-chain attack on TanStack. According to the company, no user data, production systems, or intellectual property were affected.
OpenAI detected behavior matching known malware patterns — such as unauthorized access and exfiltration of authentication-related data — in a small set of internal code repositories accessible to the two affected employees. Only a small amount of access credentials were successfully exfiltrated from the affected repositories; other code or source text remained untouched.
Upon notification, OpenAI isolated the affected systems and accounts, terminated active sessions, rotated all credentials in the impacted repositories, and temporarily suspended code deployment processes. Since the compromised repositories contained signing certificates for iOS, macOS, and Windows products, the company revoked these certificates and issued replacement certificates. As a result, users of ChatGPT Desktop, Codex App, Codex CLI, and Atlas must update their macOS apps to the latest versions. Windows and iOS apps require no action. New downloads and app launches with the old certificate will be blocked by macOS security mechanisms after June 12, 2026.
This is already the second certificate rotation in consecutive months. In mid-April 2026, OpenAI renewed its macOS signing certificates after a GitHub Actions workflow used to sign macOS apps downloaded the Axios library — manipulated by North Korean group UNC243 — on March 31.
OpenAI emphasizes that these incidents reflect growing threat evolution: attackers increasingly targeted shared software dependencies and development tools, rather than individual companies. Modern software rests on a tightly interwoven ecosystem of open-source libraries, package managers, and CI/CD infrastructure — an upstream vulnerability can spread broadly and quickly across organizations.
Source: ainews-dev.lumi-systems.io · Published May 15, 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.5.2.