OpenAI Response to Axios Developer Tool Compromise

OpenAI Response to Axios Developer Tool Compromise

OpenAI has rotated its macOS code signing certificates following a supply chain attack on the third-party developer library Axios. While OpenAI found no evidence that user data was accessed or that its systems were compromised, the company is proactively revoking the affected certificates to prevent unauthorized parties from signing malicious software as legitimate OpenAI applications.

Incident Overview and Root Cause

On March 31, 2026 (UTC), a compromise of the Axios library (version 1.14.1) led to a software supply chain attack. A GitHub Actions workflow used by OpenAI for macOS app-signing downloaded and executed this malicious version of the library.

Technical Root Cause

The incident was caused by a misconfiguration in the GitHub Actions workflow. Specifically, the workflow:

  • Used a floating tag instead of a specific commit hash for the dependency.
  • Lacked a configured minimumReleaseAge for new packages.

Impact on macOS Applications

The compromised workflow had access to the certificate and notarization material used to sign several macOS applications, ensuring users that the software originated from OpenAI. The affected products include:

  • ChatGPT Desktop
  • Codex
  • Codex-cli
  • Atlas

OpenAI's analysis suggests the signing certificate was likely not successfully exfiltrated due to the timing of the payload execution, the sequence of the job, and the method of certificate injection. However, the company is treating the certificate as compromised as a precautionary measure.

Remediation and Timeline

OpenAI has engaged a third-party digital forensics and incident response firm to validate its systems and has published new builds of all affected macOS products using a rotated certificate.

Key Deadlines and Version Requirements

Effective May 8, 2026, older versions of macOS desktop apps will no longer be supported, will not receive updates, and may cease to function. To maintain functionality, users must update to at least the following versions:

Application Minimum Required Version
ChatGPT Desktop 1.2026.051
Codex App 26.406.40811
Codex CLI 0.119.0
Atlas 1.2026.84.2

Certificate Revocation Strategy

OpenAI is implementing a phased revocation to minimize user disruption:

  1. Immediate Action: OpenAI worked with Apple to block new software notarizations using the old certificate. This ensures that any new fraudulent apps signed with the old certificate are blocked by default by macOS security protections.
  2. Grace Period: A 30-day window is provided for users to update their software via built-in mechanisms.
  3. Full Revocation: On May 8, 2026, the certificate will be fully revoked, causing macOS to block new downloads and first-time launches of apps signed with the previous certificate.

Security Verifications

OpenAI has confirmed the following regarding the scope of the incident:

  • User Data: No evidence that OpenAI user data was accessed or exposed.
  • Intellectual Property: No evidence that OpenAI systems or intellectual property were compromised.
  • Software Integrity: No evidence that published software was altered or that the potentially exposed notarization material was misused.
  • Account Security: Passwords and OpenAI API keys were not affected.
  • Platform Scope: The incident is limited to macOS applications; iOS, Android, Linux, Windows, and web versions of OpenAI software are unaffected.

Sources