OpenAI says GitHub workflow downloaded malicious Axios update, but no user data seen compromised

What happened

It has been reported that a GitHub workflow OpenAI uses to sign its macOS applications downloaded a compromised update from the popular Axios open‑source library on March 31. The tainted dependency came from a legitimate package that was recently infected, OpenAI said in a blog post. The immediate worry: the workflow touches signing keys and certificates, which are the digital rubber stamps that make an app look official.

Why it matters

If attackers had full access to that signing process, they could — allegedly — have exfiltrated a certificate and produced phony OpenAI macOS apps that appear genuine to macOS and the App Store. Scary thought, right? Imagine a convincing impostor in your Dock. OpenAI says it has not seen evidence of forged apps being distributed, nor that any user data, intellectual property, or internal systems were accessed, but supply‑chain strikes like this are a blunt reminder that classic software attacks still bite in the age of AI.

What OpenAI says and what’s next

OpenAI is treating the incident seriously and will stop supporting older macOS app versions on May 8 as a precaution. The company says there’s no sign of data compromise so far. For industry watchers, the takeaway is loud and clear: AI companies are now high‑value targets for the same supply‑chain playbook that tripped up others in recent years. Not glamorous, but very real.

Sources: axios.com