OpenAI: internal data compromised after installation of the booby-trapped TanStack library

On 15 May 2026, OpenAI — the San Francisco AI lab behind ChatGPT — confirmed it had been caught up in a software supply-chain attack targeting the widely used TanStack npm library ecosystem. Around 11 May 2026, attackers behind a campaign dubbed "Mini Shai-Hulud" published malicious versions of dozens of @tanstack/* packages; when two OpenAI employees installed or updated the booby-trapped library, malware ran in their development environments.

The malicious code was built to harvest secrets from developer and CI environments — cloud credentials, Kubernetes and Vault tokens, npm and GitHub tokens, and SSH keys. On the two affected machines, the attackers carried out credential-focused exfiltration against a limited set of internal repositories reachable from those devices. Critically, some of those repositories held OpenAI's software signing certificates for macOS, Windows, iOS, and Android.

Data and assets involved:

• Limited authentication credentials from internal code repositories
• Internal repository contents accessible to the two affected employees
• Software signing certificates for macOS, Windows, iOS, and Android present in those repos
• No evidence of access to user data, production systems, AI models, or intellectual property

OpenAI isolated the affected systems, revoked the exposed credentials and user sessions, and renewed all of its software signing certificates, republishing its applications under new signatures. Because old certificates are being fully revoked on 12 June 2026, macOS users were instructed to update ChatGPT Desktop, the Codex app, Codex CLI, and Atlas before that date. OpenAI said it found no evidence of unauthorized software modification or of malicious applications distributed using its certificates.