OpenAI forces macOS app update after supply-chain attack

OpenAI has urgently advised all macOS users to update their ChatGPT, Codex, and Atlas desktop applications by June 12, 2026, following a supply-chain attack that compromised two employee devices on May 11. The attack exploited the TanStack npm library, a widely used JavaScript utility, to inject malicious code. Although OpenAI states there is no evidence of customer data exposure, the company is proactively rotating code-signing certificates and forcing updates to prevent further exploitation. Older app versions will cease to function after the deadline, making this a critical update for all users.

The incident highlights growing risks in software supply chains, especially for AI companies reliant on open-source packages. OpenAI is working with law enforcement and security researchers to trace the attack vector and has implemented additional scanning for npm dependencies. Users who have not yet updated are urged to do so immediately through the macOS App Store or the official OpenAI download page. This marks the second security-focused forced update from OpenAI this year, following a similar move in March to patch a remote code execution vulnerability in the ChatGPT desktop client.