ChatGPT Mac app privacy risk: is your local data safe?
Two security incidents hit the ChatGPT Mac app within 24 months. One involved plaintext conversation storage with zero encryption. The other — a May 2026 supply chain attack — compromised employee devices through a poisoned npm package. If you’re pasting API keys, patient data, or client credentials into ChatGPT on macOS, the privacy risk question isn’t hypothetical anymore. It’s operational.
The Mac app has consistently lagged behind OpenAI’s web and mobile clients on security architecture. That gap has consequences. Corporate remote workers, freelancers, and developers are the highest-risk cohort — and most of them don’t know what’s sitting unencrypted on their file system right now.
What this analysis covers:
- The two distinct vulnerability vectors (local storage exposure + supply chain attack)
- Which user profiles face the most exposure
- A practical comparison of mitigation approaches
- What OpenAI’s response pattern tells us about future risk
In brief: The ChatGPT Mac app has experienced two separate security failures since 2024 — one architectural (plaintext storage), one infrastructural (supply chain compromise). Both incidents point to the same systemic gap: OpenAI’s Mac client has not received the same security rigor as its server-side infrastructure.
- Security researcher Pedro José Pereira de Vasconcelos confirmed chat histories were stored in an unencrypted local database file outside macOS’s sandboxed container, accessible to any app with broad file system permissions.
- A May 2026 supply chain attack via a compromised TanStack npm package exfiltrated limited credential material from two OpenAI employee devices, with a patch rollout completing June 12, 2026.
- No confirmed mass exploitation has been documented for either incident — but “no confirmed exploitation” isn’t the same as “no risk.”
Background: Two Incidents, One Systemic Pattern
The first alarm came in 2024. A developer noticed the ChatGPT Mac desktop app was writing conversation data to a local, unencrypted database file — stored outside macOS’s standard sandboxed container environment. That’s not a minor configuration oversight. Sandboxing is macOS’s primary defense against inter-app data access. Bypassing it means any installed application with broad file system permissions can read your full chat history silently — no permission dialog, no user alert.
According to security researcher Pedro José Pereira de Vasconcelos, a proof-of-concept worm script successfully injected itself into the conversation flow and exfiltrated chat data to a remote server without detection. OpenAI responded with a patch that relocated data into a properly sandboxed container. Case closed? Not quite.
Then May 2026 arrived. Engadget reported a supply chain attack targeting the ChatGPT Mac app through a compromised TanStack npm package — a widely-used open-source library. Two OpenAI employee devices were affected. Limited credential material from code repositories was exfiltrated. No end-user machines were confirmed compromised, and OpenAI engaged a third-party digital forensics firm to investigate.
The patch rollout for the May 2026 incident wasn’t immediate — full distribution wasn’t expected until June 12, 2026. Windows and iOS users required no action.
Two incidents. Two different attack vectors. One consistent pattern: the Mac app keeps surfacing security gaps that the web client doesn’t.
Main Analysis
The Plaintext Storage Vulnerability: Architectural Negligence
The 2024 plaintext storage issue wasn’t subtle. PrivacyScrubber’s vulnerability analysis confirms the data was stored in an unencrypted local database file, accessible to any process on the machine. No encryption at rest. No sandboxing. No access controls.
Think about what actually lands in ChatGPT conversations: database credentials pasted for debugging, patient summaries from telehealth workflows, client contract language, journalist source communications. The risk isn’t theoretical for these groups — it’s direct exposure to any malware, poorly-scoped app, or coworker with local machine access.
The highest-risk profiles are remote workers on corporate devices, freelancers handling client data, developers pasting API keys, healthcare professionals, and journalists. That’s not a niche group. That’s a significant fraction of the Mac app’s professional user base.
OpenAI’s fix — sandboxed container storage — was the right call. But the fact that it shipped without sandboxing initially raises a harder question: what does the security review process look like before a Mac app release?
This approach can fail when users assume patching alone eliminates risk. It doesn’t. A sandboxed container protects against passive file reads, but it doesn’t govern what you send into the app in the first place. That distinction matters more than most users realize.
The Supply Chain Attack: A Different, Harder Problem
The May 2026 incident is structurally different — and in some ways more concerning. Supply chain attacks through npm packages are notoriously difficult to detect before damage occurs. The SolarWinds and XZ Utils incidents showed how deeply a compromised dependency can burrow before anyone notices.
The TanStack compromise affected OpenAI employee devices, not end-user machines — an important distinction. But it signals that OpenAI’s dependency management and internal device security weren’t catching poisoned packages fast enough. A third-party forensics firm is now involved. That’s not a quick patch. That’s a full incident response cycle.
The patch timeline matters too. A three-to-four week window between disclosure and full patch distribution is a long exposure period for a widely-installed consumer application. Industry incident response benchmarks generally target 72 hours for critical consumer software vulnerabilities. The Mac app didn’t meet that bar.
Who Bears the Actual Risk
| Risk Factor | 2024 Plaintext Incident | 2026 Supply Chain Incident |
|---|---|---|
| Attack vector | Local file system access | Compromised npm dependency |
| Who’s affected | End users on shared/corporate machines | OpenAI employees (internal) |
| Data at risk | Full conversation history | Limited credential material |
| Detection difficulty | Low (silent file read) | High (supply chain) |
| Patch speed | Reactive, post-disclosure | 3-4 week rollout |
| Confirmed exploitation | None documented | None documented |
| Highest-risk profile | Remote workers, developers, healthcare | Internal engineering staff |
| Mitigation available | Yes (sandboxed container post-patch) | Update when prompted |
The 2024 incident is the one that directly affects end users. The 2026 incident is more about OpenAI’s internal security posture — though supply chain vulnerabilities can pivot to user-facing impact quickly if the compromised package touches client-side code.
Mitigation Approaches: What Actually Works
Two practical approaches exist for users handling sensitive data in AI chat interfaces.
PrivacyScrubber documents both:
Method A — Manual Anonymization (Web App): Paste raw text into PrivacyScrubber’s dashboard, click “Protect PII,” and real identifiers get replaced with tokens like [NAME_1]. Submit the sanitized prompt to ChatGPT. Paste the response back to restore original values. Browser-agnostic, no extension required. Best for one-off sensitive tasks.
Method B — Chrome Extension (Inline Redaction): A shield button appears directly in the ChatGPT interface. Click it to sanitize in place, send the cleaned prompt, and the extension automatically detokenizes the AI’s response. Full automation, no manual copy-paste. Better suited for frequent AI usage workflows.
Neither method protects against the storage vulnerability if unpatched — but both reduce the sensitivity of data that ever reaches the app in the first place. That’s the correct mental model: assume local storage could be accessible, and govern what you send accordingly. This isn’t always the answer for every workflow, but for anyone handling regulated or sensitive data, it’s the minimum viable safeguard.
Practical Implications: Three Scenarios Worth Planning For
Scenario 1 — Developer on a corporate Mac: API keys, database credentials, and internal service URLs shouldn’t be in raw prompts. The 2024 plaintext vulnerability proved any app with file system access can read those threads. Use tokenization before prompting, or better yet, use a dedicated internal AI tool with audited data handling. Audit your macOS Full Disk Access list in System Settings right now — you’ll probably find apps that shouldn’t have it.
Scenario 2 — Healthcare or legal professional: Patient summaries and privileged communications carry regulatory weight. HIPAA and attorney-client privilege don’t care whether OpenAI patched the bug last quarter. The architectural risk is documented. Strip all identifiers before they hit any AI chat interface, patched or not. Reports from healthcare compliance teams indicate that AI chat tools remain among the most common vectors for inadvertent PHI exposure — not through hacking, but through routine professional use.
Scenario 3 — Freelancer on a shared machine: Shared machines compound the local file system risk significantly. If you’re using the ChatGPT Mac app on a device others can access, delete sensitive conversation threads now. Enable FileVault if it isn’t already running. Prefer the web client, which doesn’t write local plaintext databases.
What to watch: OpenAI hasn’t published a formal security architecture document for the Mac app. If that doesn’t appear in the next six months, it’s a signal that security transparency isn’t a priority. The EU AI Act’s baseline security provisions for consumer AI applications — flagged in the Engadget reporting — could force that disclosure. Watch for regulatory guidance in Q4 2026.
Conclusion & Future Outlook
The ChatGPT Mac app privacy risk is real, documented, and not fully resolved by patches alone. Two incidents in two years from different attack vectors show a pattern, not a fluke.
Key Takeaways
- The 2024 plaintext storage bug left full conversation histories readable by any app with file system access — no exploit required
- The May 2026 supply chain attack hit internal OpenAI devices through a poisoned npm dependency, with a slow patch rollout window of three to four weeks
- No confirmed mass exploitation exists for either incident, but the attack surface was demonstrably open during both exposure windows
- Mitigation is within reach: update the app, audit file system permissions, and tokenize sensitive data before it enters any AI chat interface
What comes next: Regulatory pressure under the EU AI Act will likely push AI vendors toward mandatory local data encryption standards by late 2026 or early 2027. OpenAI’s third-party forensics engagement for the May 2026 incident may produce public findings that reshape how the Mac client handles dependencies. Whether that happens voluntarily or under regulatory compulsion is the open question.
Patches fix known vulnerabilities. They don’t fix the habit of pasting raw credentials into chat windows. That part’s on you.
References
- Vulnerability Analysis: ChatGPT Mac App Stored Conversations in Plaintext
- What data ChatGPT collects about you, and why is this important for your digital privacy
- Running ChatGPT Natively on Your Mac Through Official Apps and System Tools | Oreate AI Guides
Photo by Jonathan Kemper on Unsplash
