Trending Now - Openai Reveals Security Flaw in Third-party Tool, No Data Breach

WHO:

CNBC - OpenAI, a technology company known for developing AI applications, identified a security issue.

Techmeme - OpenAI's internal tools were involved in the incident.

WHAT:

CNBC - OpenAI stated that the attack was linked to actors believed to be associated with North Korea.

CNBC - OpenAI confirmed that the signing certificate present in the GitHub Actions workflow was likely not successfully exfiltrated by the 'malicious' payload.

CNBC - OpenAI found no evidence that user data was accessed or that its systems or intellectual property were compromised.

CNBC - OpenAI is updating its security certifications and requiring all macOS users to update their OpenAI apps to the latest versions.

CNBC - The compromised third-party developer library, Axios, was part of a broader software supply chain attack.

CNBC - OpenAI stated that passwords and OpenAI API keys were not affected by the security issue.

CNBC - Effective May 8th, 2026, older versions of OpenAI's macOS desktop apps will no longer receive updates or support.

WHERE:

CNBC - The incident involved a GitHub Actions workflow used by OpenAI to sign its macOS applications.

WHEN:

CNBC - The security issue was identified on April 8th, 2026.

CNBC - The Axios library was compromised on March 31st, 2026.

CNBC - The deadline for older versions of OpenAI's macOS desktop apps to receive updates is May 8th, 2026.

WHY:

CNBC - The root cause of the security incident was a misconfiguration in the GitHub Actions workflow.

HOW:

CNBC - The compromised Axios library was part of a broader software supply chain attack that involved a legitimate open-source software library.

CNBC - A GitHub Actions workflow used by OpenAI downloaded and executed a 'malicious' version of the Axios library.

(UPDATED April 12, 2026 01:19 UTC)

OpenAI has reported that a recent attack was linked to actors believed to be associated with North Korea. They also confirmed that the signing certificate in the GitHub Actions workflow was likely not successfully exfiltrated by the malicious payload. This incident involved a compromised Axios library, which was part of a broader software supply chain attack utilizing a legitimate open-source software library.

--

(UPDATED April 11, 2026 23:07 UTC)

OpenAI has identified a security issue involving its internal tools, which stemmed from a misconfiguration in a GitHub Actions workflow used to sign its macOS applications. The company found no evidence that user data or its systems were compromised, but it is updating its security certifications and requiring all macOS users to update their OpenAI apps to the latest versions by May 8th. The incident was linked to a compromised version of the Axios library, which was part of a broader software supply chain attack that occurred March 31st.