A security flaw recently discovered in OpenAI’s ChatGPT app for macOS raised concerns for users. Launched just last week, the app was found to store conversations with the AI in plain text on user computers. This meant that anyone with access to the device, including malicious software, could easily read these conversations.
The vulnerability was brought to light by Pedro José Pereira Vieito on the social media platform Threads. Vieito demonstrated how another app could access these unencrypted files and display the conversation text almost instantly after it occurred.
He also showed that it was fairly easy to create an app that could access ChatGPT’s plain text conversations with a click of a button and gain access to more data by simply changing file names.
The Verge was quick to inform OpenAI of the problem, after which the ChatGPT maker released a fix for the issue which encrypts the chats that were previously available in plain text.
Here is the statement from OpenAI’s spokesperson shared with The Verge.
We are aware of this issue and have shipped a new version of the application which encrypts these conversations. We’re committed to providing a helpful user experience while maintaining our high security standards as our technology evolves.
The Verge also confirmed that the update fixes the security issue in their testing.
Here is how Pedro José Pereira Vieito discovered the security issue in the first place.
I was curious about why [OpenAI] opted out of using the app sandbox protections and ended up checking where they stored the app data.
Unlike apps downloaded from Apple’s official Mac App Store, OpenAI’s ChatGPT app avoids Apple’s security restrictions (known as “sandboxing”). This means the app operates with more freedom, but also with less oversight.
One consequence of this freedom is how ChatGPT stores conversations. While OpenAI may review chats for safety and to improve their AI models (with user permission), the lack of sandboxing allows other programs, potentially malicious ones, to access these conversations if they know where to look. This vulnerability exposes user data to unauthorized parties, raising security concerns.
Source: The Verge
