OpenAI extends macOS app update deadline to June 26

OpenAI's response to the TanStack npm supply chain attack highlights the growing threat to shared software dependencies. The incident affected two employee devices and led to the exfiltration of limited credential material from internal repositories. The company engaged a third-party forensics firm and rotated code-signing certificates as a precaution, even though no evidence of malicious signing or user data compromise was found.

The decision to delay full certificate revocation until June 12, 2026—and now to extend the macOS update deadline to June 26, 2026—aims to balance security with user convenience. By blocking new notarizations and working with Apple, OpenAI ensures that fraudulent apps are blocked by default. This phased approach gives users time to update through official channels, reducing disruption while maintaining protection.

The incident occurred during OpenAI's rollout of additional security controls, and the affected devices lacked the updated configurations that would have prevented the malware download. This underscores the challenge of defending against attacks that target the software supply chain. The impact on OpenAI's reputation and user trust will depend on how effectively it manages this transition and whether any further issues arise before the new deadline.