Researchers at the Objective-See Foundation discovered a recently patched vulnerability in the macOS version of OpenAI's ChatGPT that could have let an attacker take over the app, read stored chat logs, and use the app to run commands on a victim's machine. The exploit was trivial to pull off, according to researcher Patrick Wardle, requiring only about a dozen lines of code.
The app relied on digital signature checks at three levels to confirm that requests came from OpenAI components. Wardle found that a trusted script interpreter would accept an untrusted script; by spawning that interpreter three times, the malicious script could satisfy the checks and deliver its payload to the main ChatGPT process. OpenAI acknowledged the flaw and issued a fix on September 25.
Wardle says AI agents require deep system access to function, which makes them attractive targets. He also found a similar, now-patched issue in Meta's Muse AI assistant, and has submitted a new vulnerability to OpenAI involving ChatGPT's integration with the Dots assistant. He argues that AI companies are focused on adding features while security often remains an afterthought.