ChatGPT Mac App Flaw Let Attackers Steal Data From Local Storage

Security researchers have found and helped fix a vulnerability in OpenAI's ChatGPT app for macOS that could have allowed hackers to access sensitive information stored by the application. The flaw, detailed by Wired, was patched after being reported, but it underscores a problem that gets far less attention than the hacking prowess of AI agents: the AI software running on millions of laptops is itself a soft target.

The issue lived in the local storage the ChatGPT desktop client uses on Macs. Because the app kept data in a location other applications could reach, any malicious program already running on the machine could read it without special privileges. That turns an ordinary piece of desktop software into a potential staging ground for credential theft or corporate espionage, especially on developer machines where API keys and internal documents tend to pile up.

Desktop AI clients are a relatively new class of software, and their security models have not been stress-tested the way browsers or password managers have. ChatGPT's Mac app launched in 2024 and quickly became a default tool for knowledge workers who want quick access to models without opening a browser tab. That convenience means the app often holds conversation histories, uploaded files, and cached tokens — a combination attackers find valuable.

The disclosure lands amid a broader shift in how the industry talks about AI and security. Much of the recent conversation has focused on what autonomous agents can do when weaponized, from writing phishing emails to probing networks. This episode flips the frame: the AI tool itself was the weak point, and the fix required OpenAI to change how its own client handled data on disk.

For enterprises, the patch is a reminder that approving an AI assistant for employee devices means evaluating it like any other endpoint application. Many security teams have policies for browsers and chat clients but no specific rules for AI desktop apps, which frequently request broad file and clipboard permissions. Attackers do not need a novel AI exploit when a misconfigured cache folder will do.

OpenAI has not published a detailed post-mortem, and it is unclear how long the vulnerability existed or whether anyone exploited it in the wild. Those are the questions to watch: whether the company adds sandboxing or encrypted storage to future desktop builds, and whether rival AI assistants receive the same scrutiny. Until then, the safest assumption is that any app with access to your files is also a file worth stealing.