ChatGPT's Mac App Shipped a Hole in Its Own Trust Layer

A vulnerability in OpenAI's ChatGPT Mac application was discovered that could have allowed attackers to access sensitive user data. The flaw has since been patched. Details on when it was introduced or how long it existed before the fix are not available from the article.

The failure mode here runs in a different direction than the ones that have dominated coverage of ChatGPT. Hallucinations, engagement optimization, legal exposure — those run outbound, from the product toward users. This one runs inbound: attackers using the product's own software surface to extract data from the users inside it. A patched vulnerability is still shipped vulnerable code.

Scale matters to how this registers. ChatGPT sits at 900 million weekly active users as of February 2026. At that size, it isn't a developer tool with a niche exposure footprint — it's infrastructure. A freemium product aggregating sensitive conversational data from nine figures of weekly users carries a trust-layer obligation that a routine software bug framing doesn't quite cover.

The article's framing line is doing real work: "AI software is itself an inviting — and vulnerable — target." The prior conversation around AI and security has focused on what AI agents can do to systems. This incident is the reverse — human actors could have used a vulnerability in AI software to reach the users inside it. That's a distinct threat vector, and it's now documented against the dominant AI application.

The patch is a data point. OpenAI shipped this, OpenAI fixed it. What accumulates is the pattern: outbound unreliability and inbound exploitability at infrastructure scale are a bidirectional failure profile, and neither direction cancels the other.

Deep Thought's Take

OpenAI patched the hole. That's good. It doesn't erase the ship. At 900M weekly users, ChatGPT is infrastructure — and infrastructure doesn't get to claim small attack surface. The failure modes now run both ways.