Could hackers read your ChatGPT chats from your Mac? Only if they had already installed malware on that Mac: the flaw did not let an attacker remotely break into arbitrary ChatGPT accounts. If exploited, it could expose chat logs and other app data. OpenAI says it fixed the issue in ChatGPT for macOS version 26.924.20706; install the newest update available through the app or an official OpenAI download.
What was the ChatGPT for Mac vulnerability?
Tracked as CVE-2026-100754, the vulnerability affected the ChatGPT macOS app. Researchers at the Objective-See Foundation found that the app’s process-signature checks could be manipulated so an untrusted script reached ChatGPT’s main process. WIRED reported the finding on October 2, 2026, citing the researchers. WIRED’s report describes the flaw and its potential impact.
As an Amazon Associate I earn from qualifying purchases.
The issue involved how app components checked that requests came from OpenAI components. The checks reportedly examined three process levels. A trusted script interpreter could accept an untrusted script or command list; a malicious script could spawn the interpreter three times and then make a request that passed the parent and grandparent checks. That could allow the script to reach ChatGPT’s main process.
Free tools Windows power users keep installed
One-click scans. No signup required.
Could the flaw expose your chats or other Mac data?
Potentially, yes—but only after malware was already present on the Mac. The vulnerability could then let an attacker access ChatGPT chat logs and other data stored by the app. WIRED also reported that an attacker could use ChatGPT to issue commands against browser sessions or other sensitive applications, with activity appearing to come from legitimate OpenAI software.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
That describes what exploitation could enable, not a confirmed breach. The reporting and OpenAI’s changelog do not state how many users, if any, were successfully attacked through this flaw. It was not described as a remote attack against ChatGPT accounts or a way to infect an otherwise uncompromised Mac by itself.
Which ChatGPT Mac version fixes CVE-2026-100754?
OpenAI’s ChatGPT and Codex changelog has a macOS security update entry dated September 25, 2026. It says CVE-2026-100754 was fixed in version 26.924.20706, crediting Patrick Wardle of the Objective-See Foundation. That is the cited fixed build; because newer releases may follow it, use the latest update offered through the app or OpenAI’s official download channel rather than treating that build number as necessarily current.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to protect your Mac
- Update ChatGPT for macOS. Use the app’s in-app updater, or obtain the app from OpenAI’s official download channel. Install the newest version offered.
- Check the installed version. Confirm that the app is updated; version 26.924.20706 is the fixed build named in OpenAI’s September 25 changelog.
- Do not rely on unrelated fixes. A password change, hardware accessory, or third-party cleaner is not identified as a fix for this app vulnerability.
What OpenAI and the researcher said
OpenAI spokesperson Shane Bauer told WIRED: “We continue to evolve our security practices, but recognize a need to move faster.” The statement was made in response to the report, not in OpenAI’s changelog entry.
Objective-See Foundation researcher Patrick Wardle told WIRED that software agents need broad access to do their work, comparing them to “the building manager who has access to the keys to all the rooms.” He warned that if such agents are corrupted or subverted, unprivileged code could potentially gain access to sensitive resources. The concern is about the reach an attacker might gain after compromising a process—not evidence that this vulnerability caused confirmed data theft.
Quick Recap
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5C Nano is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C Nano secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: The YubiKey 5C Nano is designed to stay plugged into your device via USB-C. Simply tap it to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Rank #3
- HARDWARE 2FA AND MFA: FIDO Alliance Certified FIDO2 v2.1 with CTAP2 plus legacy U2F and CTAP1 for strong two-factor login and passwordless sign-in on services that support security keys
- BUILDING ACCESS ON ONE CARD: MIFARE DESFire EV2 4K applet with AES encryption adds office door and physical access control alongside digital authentication
- CERTIFIED SECURE ELEMENT: An NXP Common Criteria EAL6+ certified secure controller and Java Card platform protects your keys on a tamper-resistant chip
- DUAL INTERFACE SMART CARD: Contactless NFC ISO 14443 plus ISO 7816 contact reader support in an ISO 7810 ID-1 format that is passive and needs no battery
- SWISS ENGINEERED DESIGN: Built by Cryptnox as a single card for authentication and access control and backed by a 2 year warranty
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
