A Flaw in ChatGPT’s Mac App Could Have Let Hackers Grab Sensitive Data

OpenAI just patched a vulnerability in ChatGPT's Mac app that could have exposed your entire conversation history to attackers, according to security researchers who discovered the flaw. The bug stored chats in plain text without encryption, making them easy pickings for anyone who gained access to your system.

Here's what makes this particularly noteworthy: while everyone's been obsessing over AI agents that might hack systems, we've been overlooking that AI apps themselves are becoming some of the juiciest targets out there. Your ChatGPT history likely contains passwords you asked it to help generate, proprietary code snippets, confidential business strategies, and personal information you'd never want exposed.

The vulnerability was found by security researcher Pedro José Pereira Vieito, who reported it responsibly to OpenAI. The company pushed a fix, but the incident raises questions about how these rapidly shipped AI tools handle security basics. Plain text storage of sensitive data is the kind of rookie mistake we haven't seen from major tech companies in years.

This isn't just an OpenAI problem. Every AI assistant you use, from Claude to Copilot, is aggregating huge amounts of sensitive information about your work, your thinking process, and your company's inner workings. That makes them incredibly valuable to attackers and nation-state actors looking for intelligence goldmines.

The irony here is rich: we're trusting AI tools to help us write more secure code and identify vulnerabilities in our systems, while those same tools are shipping with basic security gaps. It's a reminder that the AI boom has prioritized speed over the unglamorous work of threat modeling and security audits.

What this means for you: audit what sensitive information you're sharing with AI tools and assume that conversation history could be compromised. Use ChatGPT's temporary chat feature for anything particularly sensitive, and never paste production credentials or API keys directly into prompts. Try this workflow: before sharing code or data with an AI assistant, run this prompt first: 'I'm about to share some content with you. First, tell me what types of sensitive information I should remove or redact before pasting, specific to [your industry or use case].' Let the AI help you sanitize what you're about to share with it.