Our response to the TanStack npm supply chain attack

We are extending the update deadline for macOS users to June 26, 2026. We have been coordinating with Apple on this timeline to protect our users. New notarization with the previous certificate has been blocked, and we have found no evidence of malicious software being signed with any OpenAI certificate or unauthorized changes to our published software. These safeguards continue to help protect users by default while we complete the migration. You can update safely through an in-app update or at the official links below.

We recently identified a security issue involving a common open-source library, TanStack npm, that is part of a broader attack known as Mini Shai-Hulud ⁠ (opens in a new window) . We found no evidence that OpenAI user data was accessed, that our production systems or intellectual property were compromised, or that our software was altered.

We have taken decisive steps to protect our user data, systems, and intellectual property. As part of our response, we are taking steps to protect the process that certifies our macOS applications are legitimate OpenAI apps.

Effective June 12, 2026, older versions of our macOS desktop apps will no longer receive updates or support, and may not be functional. These versions represent the last releases signed with our outdated certificate:

The security and privacy of your information are a top priority. We’re committed to being transparent and taking quick action when issues arise. We’re sharing more technical details and FAQs below.

Two employee devices in our corporate environment were impacted by this attack. Upon identification of the malicious activity, we worked quickly to investigate, contain, and take steps to protect our systems. As part of our investigation and response, we engaged a third-party digital forensics and incident response firm.

We observed activity consistent with the malware’s publicly described behavior, including unauthorized access and credential-focused exfiltration activity, in a limited subset of internal source code repositories to which the two impacted employees had access. We confirmed that only limited credential material was successfully exfiltrated from these code repositories and that no other information or code was impacted.