This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The ChatGPT macOS application was found to store user conversation history in unencrypted plain text files, creating a security vulnerability where unauthorized local access could expose private data. The issue stemmed from the app bypassing Apple's sandboxing requirements. OpenAI subsequently released an update to encrypt the stored data, resolving the vulnerability.
OpenAI's ChatGPT macOS app stored user conversations in plain text. If accessed by a malicious actor, these conversations could have been easily read. The critical security flaw was demonstrated by a third party and ultimately resolved after OpenAI released an update to encrypt the stored data.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Vulnerabilities that can be exploited in AI systems, software development toolchains, and hardware, resulting in unauthorized access, data and privacy breaches, or system manipulation causing unsafe outputs or behavior.
Also classified as
The vulnerability exposed private, non-public user conversation histories in plain text on the user's local machine.
The incident involves a security vulnerability in the ChatGPT macOS application's local storage that could be exploited to gain unauthorized access to private user data.
Human
Due to a decision or action made by humans
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The security vulnerability was caused by human developers at OpenAI who chose to bypass Apple's sandboxing and store chat logs in unencrypted plain text, which was an unintentional risk.
A security researcher discovered that OpenAI's ChatGPT macOS application stored user conversation histories locally in unencrypted plain text due to bypassing Apple's sandboxing. OpenAI quickly patched the vulnerability. The incident represents a minor local data exposure risk with negligible national security impact.
The system is ChatGPT, which functions as an AI assistant to augment human capabilities by answering questions and holding conversations, requiring human oversight and input.
Limited Risk: The report describes ChatGPT, which is a chatbot. Under the EU AI Act, chatbots are classified as Limited Risk (Level 3) and are subject to transparency obligations.
The AI system involved is ChatGPT, which is primarily designed to function as a conversational chatbot and writing assistant.
The report provides clear, verified details about the security vulnerability, how it was discovered, and how it was resolved by OpenAI. There is no conflicting information.
None
Technology
Plain Text Local Storage
Chat histories were stored on the computer in unencrypted plain text.
Lack of App Sandboxing
The app did not utilize macOS sandboxing to restrict file access.
Data Inputs
Unencrypted User Conversations
User prompts and model responses were written directly to disk in plain text.
Human Factors
User Security Assumptions
Users assumed their private chat data was safely secured by the application.
Process and Methods
Bypassing App Store Review
Distributing via website bypassed Apple's strict sandbox security reviews.
Inadequate Security Testing
Pre-release testing failed to identify exposed plain text chat logs.
Management
Priority on Direct Distribution
Management chose website distribution over the App Store's sandbox rules.
Insufficient Security Oversight
Management approved the app release without ensuring local data encryption.
Regulatory Environment
Permissive Distribution Policies
Lack of regulations requiring sandboxing for non-App Store applications.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
