A recently patched vulnerability in ChatGPT’s macOS app could have allowed malware already running on a Mac to effectively hijack the application, access sensitive ChatGPT data and use its trusted permissions to interact with other applications.
Researchers from the Objective-See Foundation discovered the flaw and reported it to OpenAI, which acknowledged the vulnerability and deployed a fix on September 25. While exploitation required an attacker to already have malware running on the target Mac, the weakness demonstrates a broader security problem: as AI assistants gain deeper access to operating systems, compromising the assistant itself becomes increasingly valuable.
Turning ChatGPT’s Trust Against the User
The ChatGPT Mac app consists of multiple processes that communicate with each other. To prevent unauthorized software from impersonating trusted ChatGPT components, the application verifies digital signatures across several levels of the process hierarchy.
The protection was designed to ensure that a request originated from legitimate OpenAI software rather than an untrusted application. Researchers found a surprisingly simple way around it.
A trusted script interpreter could execute an untrusted script and communicate with ChatGPT’s main process. By spawning the interpreter multiple times, malicious code could construct a process hierarchy that satisfied the application’s security checks, making the request appear to originate from trusted OpenAI components.
Objective-See researcher Patrick Wardle described the exploit as extremely simple, with the proof of concept requiring only about a dozen lines of code.
Chat Histories Were Only Part of the Risk
Successful exploitation could give an attacker access to information stored by the ChatGPT application, including conversation histories. More concerning, however, was the possibility of abusing ChatGPT’s connections with other applications.
The compromised app could be instructed to perform actions involving browsers or other sensitive software, with those requests appearing to macOS as legitimate operations initiated by ChatGPT.
This effectively turns the AI application’s existing trust relationships into an escalation path.
The attack therefore illustrates an emerging security principle: an AI assistant’s value to an attacker increases alongside its capabilities. An application that can access only its own data presents one level of risk; an agent connected to browsers, files and other applications creates a significantly larger blast radius.
AI Assistants Are Becoming Privileged Software
The vulnerability arrives as AI companies race to give assistants deeper access to users’ computers. Agents increasingly need permission to interact with files, browsers, applications, credentials and external services to complete tasks autonomously.
That functionality makes them useful, but it also changes their security profile.
In traditional endpoint security, highly privileged software is treated as particularly sensitive because compromising it can provide access to everything it controls. AI agents increasingly belong in the same category.
Objective-See has already identified similar issues elsewhere. Wardle recently disclosed a vulnerability in Meta’s Muse AI assistant involving an authentication token, and he has submitted another finding to OpenAI involving the integration between ChatGPT and its always-on Dots assistant. OpenAI is reviewing that report.
The Agent Becomes Part of the Attack Surface
Much of the cybersecurity discussion around AI agents has focused on what happens when the agent itself attacks something. This vulnerability highlights the opposite problem: attackers can target the agent.
As assistants become more deeply integrated into operating systems, they effectively accumulate trust. They may know what users are working on, retain conversations, access local information and interact with other applications on the user’s behalf.
That makes securing the agent increasingly similar to securing a privileged endpoint component.
The broader lesson is straightforward:the more access an AI assistant needs to become useful, the more valuable it becomes when compromised. AI companies are rapidly expanding what their agents can do, but every new capability also expands the security boundary they need to defend.