ChatGPT for Mac app logged queries in an unencrypted file before getting caught

Apple has strict guidelines about protecting user data with sandboxing, but ChatGPT for Mac bypassed all of this by storing conversations in plain text until it was patched on June 28.


When everything is working the way it should on Mac, data should be siloed between apps so no single app can access another app's data without APIs or user permission. ChatGPT decided to ignore Apple's guidance and broke that structure by opting out of sandboxing and storing user conversations in plain text.

Storing files this way left them open for any other Mac app to find and read them freely. That means if a user's Mac was infected with malware or malicious apps, the private data shared with ChatGPT could be read freely.


Continue Reading on AppleInsider | Discuss on our Forums

nmap -sV --script vuln -p- <target-network>

tail -f /var/log/suricata/fast.log | grep <cve>

Check Vendor Security Advisory Bulletin

title: Detect Exploitation - ChatGPT for Mac app logged queries in an unencrypted file before getting caught
id: 13be7ebd-5e56-4ebc-b4ec-b57b7c21a73f
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "ChatGPT for Mac app logged que" ascii wide
    condition:
        any of them
}