OpenAI's ChatGPT Mac App Stored User Data in Unencrypted Text Files

OpenAI's ChatGPT macOS app stored user conversations in plain text. If accessed by a malicious actor, these conversations could have been easily read. The critical security flaw was demonstrated by a third party and ultimately resolved after OpenAI released an update to encrypt the stored data.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.2 AI system security vulnerabilities and attacks

The incident involves a security vulnerability in the ChatGPT macOS application's local storage that could be exploited to gain unauthorized access to private user data.

Additional risk subdomains

• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The vulnerability exposed private, non-public user conversation histories in plain text on the user's local machine.

Causal factors

• Entity: Human
• Intent: Unintentional
• Timing: Post-deployment

The security vulnerability was caused by human developers at OpenAI who chose to bypass Apple's sandboxing and store chat logs in unencrypted plain text, which was an unintentional risk.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The report describes ChatGPT, which is a chatbot. Under the EU AI Act, chatbots are classified as Limited Risk (Level 3) and are subject to transparency obligations.

AI system and alleged parties

• AI system: ChatGPT (OpenAI)
• AI purpose: Chatbot; Writing Assistant
• Behaviour type: Assistant
• Alleged developer: OpenAI
• Alleged deployer: OpenAI
• Alleged harmed parties: ChatGPT macOS users

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

People affected

• Occurrences reported: 1
• People reportedly exposed: 2

Potential causes

Management

• Priority on Direct Distribution: Management chose website distribution over the App Store's sandbox rules.
• Insufficient Security Oversight: Management approved the app release without ensuring local data encryption.

Technology

• Plain Text Local Storage: Chat histories were stored on the computer in unencrypted plain text.
• Lack of App Sandboxing: The app did not utilize macOS sandboxing to restrict file access.

Data Inputs

• Unencrypted User Conversations: User prompts and model responses were written directly to disk in plain text.

Human Factors

• User Security Assumptions: Users assumed their private chat data was safely secured by the application.

Process and Methods

• Bypassing App Store Review: Distributing via website bypassed Apple's strict sandbox security reviews.
• Inadequate Security Testing: Pre-release testing failed to identify exposed plain text chat logs.

Regulatory Environment

• Permissive Distribution Policies: Lack of regulations requiring sandboxing for non-App Store applications.

Information quality

• Classification confidence: High
• Reason for confidence: The report provides clear, verified details about the security vulnerability, how it was discovered, and how it was resolved by OpenAI. There is no conflicting information.

A security researcher discovered that OpenAI's ChatGPT macOS application stored user conversation histories locally in unencrypted plain text due to bypassing Apple's sandboxing. OpenAI quickly patched the vulnerability. The incident represents a minor local data exposure risk with negligible national security impact.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The vulnerability has been patched by OpenAI, representing no immediate or near-term active threat.
• Autonomy: Human-controlled. The AI system functions as a user-driven assistant and the vulnerability relates to local data storage, involving no autonomous decision-making.
• Novelty: Established threat. Storing sensitive data in unencrypted local files is a well-understood, classic software security vulnerability.

Impact by dimension

• Physical security: Negligible. No physical systems, infrastructure, or human safety elements were impacted or threatened by this local software vulnerability.
• Information security: Minor. Storing chat histories in plain text locally created a minor risk of data exposure for users, including potentially sensitive government or corporate personnel, though no active exploitation was reported.
• Sovereignty: Negligible. No impact on government decision-making, electoral systems, or state authority.
• Economic security: Negligible. No significant threat to financial systems, critical supply chains, or strategic technological competitive advantage.
• Societal stability: Negligible. While a privacy vulnerability existed, it did not result in mass surveillance, systematic discrimination, or large-scale civil unrest.