Recently, OpenAI's ChatGPT application, launched for macOS, encountered a significant security issue. Reports from The Verge revealed that the application stored user conversations in plain text format on the users' computers. This meant that if an unauthorized party or a malicious application gained access to a user's computer, they could easily read conversations with ChatGPT and the data it contained.
Security researcher Pedro José Pereira Vieito demonstrated in a thread that access to these conversations could be achieved by other applications simply by accessing ChatGPT's storage files. Pereira Vieito also shared an application that could directly read ChatGPT conversations right after they occurred. Following The Verge's contact with OpenAI regarding this issue, the company then released an update that encrypted these conversations.
According to OpenAI spokesperson Taya Christianson, "We are aware of this issue and have released a new version of the application that encrypts these conversations."
Issue Identified by Pedro José Pereira Vieito
Pedro José Pereira Vieito explained that he discovered the security flaw in the ChatGPT application after noticing that OpenAI did not use sandboxing protection in their application. Pereira Vieito then investigated where the application's data was stored and found that user conversations were stored in plain text, without encryption.
Since OpenAI does not distribute the ChatGPT application via the Mac App Store, the application is not bound by the sandboxing requirements imposed by Apple for software distributed through that platform.
Preventive Measures by OpenAI
Before the update was released, OpenAI might have been reviewing ChatGPT conversations for security and model training purposes. However, the possibility of access by unknown third parties aware of where to find this data should not have occurred.
After users downloaded the updated application, Pereira Vieito's created application could no longer read user conversations in plain text. OpenAI's actions demonstrate their responsiveness in addressing security issues within their application.
