A supply chain attack compromised two OpenAI employee devices on May 11, 2026. Internal credentials were stolen, but no user data or intellectual property was affected.
The incident is part of a wave of attacks targeting software supply chains, and requires OpenAI macOS users to act before a specific deadline. Here's what we know.
A limited breach, but with concrete consequences
On May 11, 2026 UTC, TanStack, a widely used open-source library, was compromised as part of a larger software supply chain attack known as 'Mini Shai-Hulud'. Two OpenAI employee devices, located within the company's internal IT environment, were affected.
OpenAI confirmed it immediately launched an investigation, engaged a third-party digital forensics firm, and contained the incident. The company observed activity consistent with the malware's publicly described behavior, including unauthorized access and credential-focused exfiltration activity, in a limited subset of internal source code repositories to which the two impacted employees had access. (We observed activity consistent with the malware’s publicly described behavior, including unauthorized access and credential-focused exfiltration activity, in a limited subset of internal source code repositories to which the two impacted employees had access.)
Only a limited volume of identification data was successfully extracted from these repositories, and no other information or lines of code were affected. OpenAI specified that it found no evidence that user data, production systems, or the company's intellectual property were compromised.
What macOS users need to do before June 12, 2026
The most tangible point for users concerns the code signing certificates. Signing keys for Windows, macOS, iOS, and Android were affected by this incident. All OpenAI applications are being re-signed and will be released with new certificates.
Once the current certificate is fully revoked on June 12, 2026, new installations and launches of applications signed with the old certificate will be blocked by macOS security protections. Windows and iOS users are not affected and have no action to take.
The macOS applications affected by this update requirement are as follows:
ChatGPT Desktop (latest version signed with the old certificate: 1.2026.125)
Codex App (26.506.31421)
Codex CLI (0.130.0)
Atlas (1.2026.119.1)
OpenAI advises users to update through the integrated update mechanisms within the applications or from the official download pages. The company also warns against installing any application from links received via email, message, advertisement, or third-party website. OpenAI has not detected any malicious applications signed with its compromised certificates.
How TanStack was compromised in six minutes
To understand how OpenAI was affected, we need to go back to the initial attack mechanism against TanStack. On May 11, 2026, between 7:20 PM and 7:26 PM UTC, an attacker published 84 malicious versions across 42 npm packages from the family @tanstack/* by combining three techniques: abuse of the pull_request_target trigger (called 'Pwn Request'), GitHub Actions cache poisoning across the fork/base trust boundary, and in-memory extraction of an OIDC token from the GitHub Actions runner process.
No npm tokens were stolen, and TanStack's own npm publishing pipeline was not compromised. The attacker exploited the system's implicit cache trust to have the project's legitimate pipeline publish the malicious packages itself. Tanner Linsley, founder of TanStack, summarized the situation in the post-mortem published on the official TanStack website: "It's clear that no maintainer was phished, had a password leak, or a token stolen from their account. The attacker managed to create a path where our own CI pipeline stole its own publish token for them, at the exact moment it was created, via a cache that everyone in the chain implicitly trusted." (Just to be clear, no maintainer was phished, had a password leak, or a token stolen from their account. The attacker managed to engineer a path where our own CI pipeline stole its own publish token for them, at the exact moment it was created, by way of a cache that everyone in the chain implicitly trusted.)
The malicious versions were publicly detected within 20 to 26 minutes by an external researcher, ashishkurmi, working for the company stepsecurity. All affected versions have since been deprecated on npm.
Mini Shai-Hulud: a campaign that goes far beyond OpenAI
OpenAI is not the only victim of this wave. A critical supply chain compromise was reported on May 12, 2026, affecting TanStack, Mistral AI, UiPath, and over 160 additional npm and PyPI packages. This attack, attributed to the TeamPCP group and dubbed 'Mini Shai-Hulud,' allows attackers to steal credentials and automatically spread within the npm ecosystem.
Mistral AI confirmed in an update to its security advisory that it was also affected by the TanStack compromise, leading to the publication of compromised versions of its npm and PyPI SDKs. Only one developer device was impacted, and there is no indication that its infrastructure was compromised.
This attack marks the third documented wave from TeamPCP, following the compromise of SAP npm packages in late April 2026 and PyTorch Lightning on April 30, 2026. The group, which was itself hacked by other malicious actors in early May, has since announced a public contest inviting other hackers to use its 'Shai-Hulud' tool against open-source projects, offering Monero rewards.
The attack on TanStack is also not an isolated incident in time. In March 2026, North Korean hackers took control of the Axios library, compromised by the UNC1069 group. It was precisely this incident that led OpenAI to begin strengthening its own defenses, a few weeks before being targeted itself.
OpenAI caught by incomplete security deployment
One of the most instructive elements of this incident concerns the timing of OpenAI's protective measures. Following the Axios incident, OpenAI accelerated the deployment of specific security controls and technologies aimed at reducing the impact of supply chain attacks. These measures included, in particular, strengthening sensitive credentials in the CI/CD pipeline, deploying package manager configurations with controls like minimumReleaseAge, and adding security software to validate the provenance of new packages.
This incident occurred during the gradual rollout of these controls. The two affected devices did not yet have the updated configurations that would have prevented the download of the new package containing the malware. In other words, the protections existed but had not yet been applied to the machines concerned.
OpenAI drew a broader conclusion from this experience, published in its official blog post: "This incident reflects a broader shift in the threat landscape: attackers are increasingly targeting shared software dependencies and development tooling rather than any single company." (This incident reflects a broader shift in the threat landscape: attackers are increasingly targeting shared software dependencies and development tooling rather than any single company.)
For developers, companies, and users of applications based on open-source ecosystems, this episode is a reminder that the attack surface is no longer limited to internal perimeters. Modern software is built on a deeply interconnected ecosystem of open-source libraries, package managers, and CI/CD infrastructures, meaning a vulnerability introduced upstream can spread widely and rapidly across organizations. For OpenAI's macOS users, the immediate priority remains simple: update their applications before June 12, 2026, to avoid any service interruption.
No Comment! Be the first one.