The company says it has rotated credentials across all affected repositories, revoked user sessions, and temporarily restricted code-deployment workflows. No customer data or intellectual property was affected in the attack, it says.The compromised repositories contained code-signing certificates for iOS, macOS, Windows, and Android products, and OpenAI decided to revoke the certificates and re-sign all applications.macOS users will need to update their applications by June 12, 2026. After that date, these products will no longer receive updates and might stop functioning properly.“We are updating our security certificates, which will require all macOS users to update their OpenAI apps to the latest versions. This helps prevent any risk, however unlikely, of someone attempting to distribute a fake app that appears to be from OpenAI,” the company says.OpenAI says it is also coordinating with platform providers to stop new notarizations and prevent the malicious use of the stolen certificates.“We have also reviewed all notarization of software using our previous certificates to confirm no unexpected software signing has occurred with these keys, and validated that our published software did not have unauthorized modifications. We have found no evidence of compromise or risk to existing software installations,” the company says.The incident, OpenAI says, occurred during the transition to hardened configurations and credentials material, which was prompted by theAxios supply chain attackthat occurred at the end of March, and whichaffecteda certificate and notarization material used to sign OpenAI’s macOS applications.Because the transition was implemented in phases, the two employee devices had not yet been updated with the new configurations, which would have prevented the malicious package downloads.Related:DigiCert Revokes Certificates After Support Portal HackRelated:Worries About AI’s Risks to Humanity Loom Over the Trial Pitting Musk Against OpenAI’s LeadersRelated:Checkmarx Confirms Data Stolen in Supply Chain AttackRelated:OpenAI Widens Access to Cybersecurity Model After Anthropic’s Mythos Reveal

The compromised repositories contained code-signing certificates for iOS, macOS, Windows, and Android products, and OpenAI decided to revoke the certificates and re-sign all applications.macOS users will need to update their applications by June 12, 2026. After that date, these products will no longer receive updates and might stop functioning properly.“We are updating our security certificates, which will require all macOS users to update their OpenAI apps to the latest versions. This helps prevent any risk, however unlikely, of someone attempting to distribute a fake app that appears to be from OpenAI,” the company says.OpenAI says it is also coordinating with platform providers to stop new notarizations and prevent the malicious use of the stolen certificates.“We have also reviewed all notarization of software using our previous certificates to confirm no unexpected software signing has occurred with these keys, and validated that our published software did not have unauthorized modifications. We have found no evidence of compromise or risk to existing software installations,” the company says.The incident, OpenAI says, occurred during the transition to hardened configurations and credentials material, which was prompted by theAxios supply chain attackthat occurred at the end of March, and whichaffecteda certificate and notarization material used to sign OpenAI’s macOS applications.Because the transition was implemented in phases, the two employee devices had not yet been updated with the new configurations, which would have prevented the malicious package downloads.Related:DigiCert Revokes Certificates After Support Portal HackRelated:Worries About AI’s Risks to Humanity Loom Over the Trial Pitting Musk Against OpenAI’s LeadersRelated:Checkmarx Confirms Data Stolen in Supply Chain AttackRelated:OpenAI Widens Access to Cybersecurity Model After Anthropic’s Mythos Reveal

macOS users will need to update their applications by June 12, 2026. After that date, these products will no longer receive updates and might stop functioning properly.“We are updating our security certificates, which will require all macOS users to update their OpenAI apps to the latest versions. This helps prevent any risk, however unlikely, of someone attempting to distribute a fake app that appears to be from OpenAI,” the company says.OpenAI says it is also coordinating with platform providers to stop new notarizations and prevent the malicious use of the stolen certificates.“We have also reviewed all notarization of software using our previous certificates to confirm no unexpected software signing has occurred with these keys, and validated that our published software did not have unauthorized modifications. We have found no evidence of compromise or risk to existing software installations,” the company says.The incident, OpenAI says, occurred during the transition to hardened configurations and credentials material, which was prompted by theAxios supply chain attackthat occurred at the end of March, and whichaffecteda certificate and notarization material used to sign OpenAI’s macOS applications.Because the transition was implemented in phases, the two employee devices had not yet been updated with the new configurations, which would have prevented the malicious package downloads.Related:DigiCert Revokes Certificates After Support Portal HackRelated:Worries About AI’s Risks to Humanity Loom Over the Trial Pitting Musk Against OpenAI’s LeadersRelated:Checkmarx Confirms Data Stolen in Supply Chain AttackRelated:OpenAI Widens Access to Cybersecurity Model After Anthropic’s Mythos Reveal

“We are updating our security certificates, which will require all macOS users to update their OpenAI apps to the latest versions. This helps prevent any risk, however unlikely, of someone attempting to distribute a fake app that appears to be from OpenAI,” the company says.OpenAI says it is also coordinating with platform providers to stop new notarizations and prevent the malicious use of the stolen certificates.“We have also reviewed all notarization of software using our previous certificates to confirm no unexpected software signing has occurred with these keys, and validated that our published software did not have unauthorized modifications. We have found no evidence of compromise or risk to existing software installations,” the company says.The incident, OpenAI says, occurred during the transition to hardened configurations and credentials material, which was prompted by theAxios supply chain attackthat occurred at the end of March, and whichaffecteda certificate and notarization material used to sign OpenAI’s macOS applications.Because the transition was implemented in phases, the two employee devices had not yet been updated with the new configurations, which would have prevented the malicious package downloads.Related:DigiCert Revokes Certificates After Support Portal HackRelated:Worries About AI’s Risks to Humanity Loom Over the Trial Pitting Musk Against OpenAI’s LeadersRelated:Checkmarx Confirms Data Stolen in Supply Chain AttackRelated:OpenAI Widens Access to Cybersecurity Model After Anthropic’s Mythos Reveal

OpenAI says it is also coordinating with platform providers to stop new notarizations and prevent the malicious use of the stolen certificates.“We have also reviewed all notarization of software using our previous certificates to confirm no unexpected software signing has occurred with these keys, and validated that our published software did not have unauthorized modifications. We have found no evidence of compromise or risk to existing software installations,” the company says.The incident, OpenAI says, occurred during the transition to hardened configurations and credentials material, which was prompted by theAxios supply chain attackthat occurred at the end of March, and whichaffecteda certificate and notarization material used to sign OpenAI’s macOS applications.Because the transition was implemented in phases, the two employee devices had not yet been updated with the new configurations, which would have prevented the malicious package downloads.Related:DigiCert Revokes Certificates After Support Portal HackRelated:Worries About AI’s Risks to Humanity Loom Over the Trial Pitting Musk Against OpenAI’s LeadersRelated:Checkmarx Confirms Data Stolen in Supply Chain AttackRelated:OpenAI Widens Access to Cybersecurity Model After Anthropic’s Mythos Reveal

“We have also reviewed all notarization of software using our previous certificates to confirm no unexpected software signing has occurred with these keys, and validated that our published software did not have unauthorized modifications. We have found no evidence of compromise or risk to existing software installations,” the company says.The incident, OpenAI says, occurred during the transition to hardened configurations and credentials material, which was prompted by theAxios supply chain attackthat occurred at the end of March, and whichaffecteda certificate and notarization material used to sign OpenAI’s macOS applications.Because the transition was implemented in phases, the two employee devices had not yet been updated with the new configurations, which would have prevented the malicious package downloads.Related:DigiCert Revokes Certificates After Support Portal HackRelated:Worries About AI’s Risks to Humanity Loom Over the Trial Pitting Musk Against OpenAI’s LeadersRelated:Checkmarx Confirms Data Stolen in Supply Chain AttackRelated:OpenAI Widens Access to Cybersecurity Model After Anthropic’s Mythos Reveal

The incident, OpenAI says, occurred during the transition to hardened configurations and credentials material, which was prompted by theAxios supply chain attackthat occurred at the end of March, and whichaffecteda certificate and notarization material used to sign OpenAI’s macOS applications.Because the transition was implemented in phases, the two employee devices had not yet been updated with the new configurations, which would have prevented the malicious package downloads.Related:DigiCert Revokes Certificates After Support Portal HackRelated:Worries About AI’s Risks to Humanity Loom Over the Trial Pitting Musk Against OpenAI’s LeadersRelated:Checkmarx Confirms Data Stolen in Supply Chain AttackRelated:OpenAI Widens Access to Cybersecurity Model After Anthropic’s Mythos Reveal

Because the transition was implemented in phases, the two employee devices had not yet been updated with the new configurations, which would have prevented the malicious package downloads.Related:DigiCert Revokes Certificates After Support Portal HackRelated:Worries About AI’s Risks to Humanity Loom Over the Trial Pitting Musk Against OpenAI’s LeadersRelated:Checkmarx Confirms Data Stolen in Supply Chain AttackRelated:OpenAI Widens Access to Cybersecurity Model After Anthropic’s Mythos Reveal

Related:DigiCert Revokes Certificates After Support Portal HackRelated:Worries About AI’s Risks to Humanity Loom Over the Trial Pitting Musk Against OpenAI’s LeadersRelated:Checkmarx Confirms Data Stolen in Supply Chain AttackRelated:OpenAI Widens Access to Cybersecurity Model After Anthropic’s Mythos Reveal

Related:Worries About AI’s Risks to Humanity Loom Over the Trial Pitting Musk Against OpenAI’s LeadersRelated:Checkmarx Confirms Data Stolen in Supply Chain AttackRelated:OpenAI Widens Access to Cybersecurity Model After Anthropic’s Mythos Reveal

Source: SecurityWeek