New Delhi: OpenAI revealed a security vulnerability based on a breached third-party developer tool, highlighting the risks posed by the vulnerability of
software supply chains. The company verified that the problem was with a popular library known as Axios but highlighted that it has no indication that user data or systems were accessed.
The incident, which was discovered on Friday, led to an immediate response of OpenAI. The company stated that while a malicious version of the tool was briefly executed within its development workflow, critical assets such as user data, passwords, API keys, and intellectual property remained secure.
What happened: Third-party tool compromised
On March 31, OpenAI disclosed that a popular developer library, Axios, was compromised as a part of a larger software supply chain attack. As the company claims, the attack is thought to be connected with the threat actors related to North Korea.
The hacked tool was run via a GitHub Actions workflow that is internally used by OpenAI. This workflow had access to sensitive materials, including certificates to sign and verify macOS applications like ChatGPT Desktop, Codex, Codex CLI, and Atlas.
No data breach, no system compromise
Although the incident was serious, OpenAI confirmed its investigation did not reveal any evidence of data exfiltration or system compromise. The company indicated that the signing certificate that came with the workflow was probably not accessed successfully by the attackers.
OpenAI also ensured that user credentials such as passwords and API keys were not compromised. The root cause of the problem was identified to be a misconfiguration of the GitHub Actions workflow, which was corrected.
Urgent update for macOS users
To be on the safe side, OpenAI is ensuring that its app certification process is enhanced to avoid spreading fake or modified applications. The company has encouraged all users of macOS to update the OpenAI applications in their systems to the latest version.
Moreover, OpenAI reported that the older macOS desktop applications will no longer receive updates and support as of May 8. These versions can ultimately become useless.
The company has already started to put in place better security measures to protect its development and distribution pipelines. According to OpenAI, it is revamping its certification systems to make sure that only trusted apps are accepted and certified.
The event underscores the increasing dangers in the software supply chain, whereby hackers use third-party tools to compromise bigger systems. OpenAI’s swift response underscores the importance of proactive security monitoring in today’s evolving threat landscape.
