A now-patched vulnerability in ChatGPT’s Mac app could have let an attacker essentially take over ChatGPT on a victim’s computer — reaching all of the app’s chat logs and stored data, plus interconnections such as browser sessions, as Wired reported. OpenAI acknowledged the flaw and the fix in its system change log on September 25. The finding came from researchers at the Objective-See Foundation, and the detail that matters most is not the bug itself but the shape of it: a desktop AI app that runs with your rights, holds standing access to your data, and can be borrowed by anything that reaches that process.
Key facts
| Fact | Detail |
|---|---|
| Question answered | A Patched ChatGPT Mac App Flaw Shows the Real Risk in Desktop AI: Standing Access |
| Short answer | Researchers at the Objective-See Foundation found a now-patched flaw in ChatGPT’s Mac app that could have let local malware take over the app, read chat logs and drive other applications. |
| Reading time | ~4 min |
| Last updated | 2026-10-03 |
What was disclosed
- Who found it: the Objective-See Foundation, with longtime macOS security researcher Patrick Wardle presenting analysis of several AI macOS application bugs at the Objective by the Sea conference in November.
- What it allowed: taking over the app, reading chat logs and other stored data, and using ChatGPT to run commands for the attacker — including opening a browser or other sensitive applications.
- How it looked: to the rest of the system, those malicious requests appeared as legitimate instructions issued by the OpenAI software.
- Prerequisite: the attacker already needed malware installed on the target machine.
- Effort: Wardle described the exploit as “insanely trivial”, with a proof of concept of roughly a dozen lines of code.
- Status: patched, and disclosed by OpenAI in its change log on September 25.
The article also notes two adjacent findings: a patched flaw in the dictation feature of Meta’s Muse AI assistant that a local attacker could have used to grab a mishandled authentication token, and a newer report from Wardle to OpenAI about the integration between ChatGPT and the company’s always-on Dots assistant, which OpenAI is currently reviewing.
Why “standing access” is the whole story
Wardle’s own framing is the clearest explanation of the risk model:
“Agents need a lot of access to do their job. They are like the building manager who has access to the keys to all the rooms. So if they can be corrupted or subverted, that’s super problematic.”
That is the trade every desktop AI product makes. To be useful, an app that reads your files, drives your browser and runs commands needs the keys. Once it has them, the security question stops being “is the model well behaved” and becomes “who else can reach this process, and what is the blast radius if they do.”
A chat log is not a trivial asset either. It is a working record of your projects, the documents you pasted in, and the systems you named — which is exactly what makes it a target worth a dozen lines of code.
What this means if you run an agent on Windows
The platform differences are real, and none of them change the underlying pattern. A Windows desktop agent also runs as your user, also keeps local state such as conversation history and file paths, and also tends to be granted broad folder access because narrow access makes it less useful.
Practical conclusions:
- Local malware is the premise, not an edge case. If something unwanted is already running on the machine, every trusted app becomes a bridge. Reducing what you download and run casually is part of AI security, not separate from it.
- Scope beats trust. Give the agent the folders it needs and no more. An app that cannot read a directory cannot leak it after being subverted.
- Treat agent session data as sensitive. Conversation history, cached file contents and saved tokens deserve the same care as a browser profile.
- Keep the app on current builds. This specific flaw is fixed; the general class is maintained by staying patched.
- Watch the feature surface. As Wardle puts it, “the more features, the broader the attack surface” — so every added integration is also added exposure. An always-on assistant integration is the current example worth watching.
A note on our own defaults
The same logic drives how MOOGH is built: a desktop agent that works on your own machine, where the workload that touches your files stays local, so there is no third-party service holding a session that can be borrowed. That does not make any software risk-free — it changes what there is to reach. You can Download it and start by pointing it at a single test folder to see exactly what it can and cannot open.
The takeaway
A dozen lines of code, one already-present piece of malware, and an app that held the keys. That is the desktop AI threat model in one sentence, and it is why scoping permissions tightly matters more than any claim about which assistant is safest. Patch, scope, and keep the machine you run agents on reasonably clean.
Related reading: