MacSouverain

FREN
radar

OpenAI Certificate Compromised, Update ChatGPT Mac Before June 12th

ChatGPT, Codex, and Atlas on Mac: Mandatory update before June 12, 2026. OpenAI cert revoked after npm supply-chain attack.

You’re using ChatGPT, Codex, or Atlas in a native app on your Mac. On June 12, in a few days, these apps will refuse to launch if you haven’t updated. Not a bug, a certificate revocation due to a supply-chain attack. Here’s what happened and what you need to do.

The Facts

On May 11, 2026, a collective called TeamPCP published 84 tampered versions of 42 @tanstack/* packages on npm in just six minutes. Two OpenAI employees consumed one of these packages that evening. The malware, Mini Shai-Hulud, exfiltrated credentials that granted access to internal repositories containing OpenAI’s code-signing tools. Not user conversations or models, just the keys that prove to macOS that an app comes from OpenAI.

OpenAI announced publicly on May 13, 2026, that the compromised certificate would be revoked on June 12, 2026. On Apple’s end, this means Gatekeeper and notarization will refuse any version signed with the old certificate. In practical terms, the affected versions are:

  • ChatGPT Desktop ≤ 1.2026.125
  • Codex App ≤ 26.506.31421
  • Codex CLI ≤ 0.130.0
  • Atlas (OpenAI browser) ≤ 1.2026.119.1

These won’t launch after June 12. iOS and Windows versions are re-signed server-side, no user action needed.

The worm’s source code was published by TeamPCP on May 12, with a $1,000 bounty on BreachForums for the largest supply-chain attack using their tool. Not a defensive bug bounty, an offensive reward. The CVE reference is CVE-2026-45321.

Why This Matters to You

You didn’t do anything wrong, but you still have to act. That’s the essence of a supply-chain attack. Your user hygiene could be perfect, but if the app you’ve installed gets compromised four levels up, in an npm dependency you’ll never know about, you’re the one left with the problem. The compromised certificate, the revoked signing mechanism, the app that won’t launch - it all happens on your end without you clicking anything.

The good news is the revocation mechanism works. Gatekeeper and Apple’s notarization are designed for this: preventing an attacker from using a stolen certificate to sign malware downstream. OpenAI did their job by properly revoking. Apple did their job by blocking. The system held up. OpenAI communicated clearly and promptly, with specific dates and versions - not the norm in the industry.

The bad news is it raises a doctrinal question that goes beyond OpenAI. A native app on your Mac is local code running with a trust certificate, automatic update channel, system permissions, and a network of upstream dependencies you have no visibility into. When one of these dependencies gets compromised - and they all do - the problem comes down to you.

What You Need to Do Now

1. Open ChatGPT.app, go to Preferences → About. If you’re on 1.2026.125 or earlier, start the update. If nothing appears, download directly from chatgpt.com/download. Never a mirror, never a shared link.

2. If you’re using Codex App or Codex CLI, do the same check. CLI: codex --version then npm update -g @openai/codex or reinstall cleanly. For Atlas, update is integrated.

3. Make sure macOS is up-to-date, with Gatekeeper strengthened on Sequoia 15.x and Sonoma 14.7+. Older versions are more lenient in notarization checks at launch.

4. Use the window to ask yourself a doctrinal question: what does the native ChatGPT app give you that chatgpt.com in Safari doesn’t? System dictation, keyboard shortcuts, Spotlight integration - okay. If you don’t use any of these, the browser reduces your attack surface. No signature certificate to manage, no silent updates, no persistent local code. The habit applies to Claude Desktop, Perplexity, Mistral AI Chat, and any other third-party AI apps you’ve installed without really knowing why. A native app on your Mac is a security debt - sometimes justified, sometimes not.

Also read, Anthropic MCP, design flaw that opens RCE. Same logic, third-party AI code descending into dangerous local execution.

Sources