macOS Flags ChatGPT App, Reinstallation Restores Notarization

According to OpenAI's own security disclosure, a GitHub Actions workflow used in OpenAI's macOS app-signing process executed a compromised version of the Axios developer library on March 31, 2026, as part of a broader npm supply-chain attack; the workflow had access to the certificate used to notarize ChatGPT Desktop, Codex, Codex CLI, and Atlas. OpenAI says its investigation found the certificate was likely not successfully exfiltrated, but the company is treating it as compromised out of caution, revoking and rotating it, and giving users until May 8, 2026 to update. As that transition has rolled out, Mac users have reported macOS's Xprotect system flagging older, still-validly-signed ChatGPT builds and moving them to the Trash; MacTrast and Forbes report reinstalling or updating via OpenAI's official download page restores a notarized, launchable app.

1. March 31, 2026

   A GitHub Actions workflow in OpenAI's macOS app-signing process executed a compromised version of the Axios npm package during a broader industry supply-chain attack.

2. April 10, 2026

   OpenAI publicly disclosed the incident, said it found no evidence of compromised user data, and announced it would rotate its macOS code-signing certificate.

3. May 8, 2026

   OpenAI's revocation deadline; older macOS app builds signed with the previous certificate lose support and may stop launching.

4. May 28, 2026

   Malwarebytes reported a separate impersonation site, openew.app, distributing credential-stealing malware disguised as ChatGPT desktop installers.

Malwarebytes reports the openew.app site closely mimics OpenAI's real download experience and serves platform-specific payloads: a Windows credential-stealing loader distributed as Chat_GPT.exe, and, for macOS, a disk image installing Odyssey Stealer, a fork of the Atomic Stealer (AMOS) malware family. Malwarebytes says the macOS payload targets browser passwords, cookies, Telegram sessions, and cryptocurrency wallets, and attempts to replace legitimate Ledger and Trezor wallet apps with trojanized versions. This campaign is unrelated to OpenAI's certificate rotation; it opportunistically targets users searching for ChatGPT downloads via search ads and SEO.

For teams supporting end users, the two issues call for different responses: the Xprotect and notarization warnings are resolved simply by updating through OpenAI's official channels or in-app updater, while the openew.app campaign requires user education, since the fake site presents a convincing OpenAI-branded experience with a legitimate-looking HTTPS padlock. Organizations that deploy ChatGPT or similar AI desktop clients at scale should distribute updates through MDM or verified enterprise channels rather than relying on individual users to find the correct download link via search.

• •Whether OpenAI accelerates its certificate revocation timeline if it finds evidence the exposed material was misused, as it said it would.
• •Additional takedown or blocklist action against openew.app and copycat domains.
• •Whether other AI vendors report similar supply-chain exposure through the same Axios npm compromise, which OpenAI describes as part of a broader industry incident.

This episode is a reminder that legitimate security remediation and opportunistic malware campaigns can look identical to end users, both show up as "something is wrong with my ChatGPT app." OpenAI's own disclosure is unusually detailed and, per its own account, found no evidence of actual compromise, but the resulting user confusion created an opening that a genuine malware campaign moved to exploit within weeks.