OpenAI rotates macOS certificates after TanStack npm attack

Start here

In everyday words

A hacked software package affected some OpenAI employee machines. OpenAI is replacing the certificates that prove its Mac apps are legitimate, so macOS users need to update to keep the apps working and reduce fake-installer risk.

Need a meaning?

Quick Sip

What you need to know

Who is affected: AI users, security teams, policy watchers
What changed: On May 13, 2026, OpenAI published an incident report on the TanStack npm supply chain attack and said it is rotating code-signing certificates. It says two employee devices were impacted, but it found no evidence of user data exposure or production compromise; macOS users must update desktop apps by June 12, 2026.
Why it matters: Supply-chain attacks can jump from a dependency into developer tooling and then into signing keys. Rotating certificates reduces the risk of impersonation, but it also shows why timely updates and official download links matter for desktop AI tools.
What to watch next: Watch whether other software vendors tighten dependency controls and signing-key handling in CI/CD, and how widely the broader Mini Shai-Hulud supply-chain campaign spreads across popular open-source packages.

Four useful details

OpenAI says it found no evidence that user data was accessed or that production systems or software releases were altered.
It says two employee devices were impacted and limited credential material was exfiltrated from a small subset of internal repositories.
OpenAI says impacted repositories included product signing certificates, so it is rotating certificates and asks macOS users to update apps by June 12, 2026.

OpenAI · Official AnnouncementOffering Zero Data Retention for frontier models

Adds source-backed context on ai safety from OpenAI.