X · X// 4h agoSECURITY INCIDENT

OpenAI flags Codex App in Axios incident

OpenAI says it identified a security issue involving the third-party Axios library as part of a broader industry supply-chain incident. The company says there is no evidence that OpenAI user data was accessed, its systems were compromised, or its software was altered, but it is rotating macOS signing material and asking users to update to the latest versions of its apps, including Codex App.

// ANALYSIS

Hot take: this is a trust-and-distribution incident more than a product flaw, and OpenAI is responding like a company that wants to get ahead of any downstream confusion about app authenticity.

–The incident appears to have hit the macOS app-signing workflow, not the product itself.
–OpenAI says the malicious Axios payload ran in a GitHub Actions process, which is a classic supply-chain blast radius problem.
–The company is treating the signing certificate as compromised out of caution, even though it found no evidence of misuse.
–The update pressure is real: older macOS builds may stop receiving support or functioning after the revocation window.
–The message is also a user-safety play: only update via in-app updates or official OpenAI links.

// TAGS

openaicodexsecuritysupply-chainaxiosmacosapp-signing

DISCOVERED

4h ago

2026-04-16

PUBLISHED

5d ago

2026-04-11

RELEVANCE

10/ 10

AUTHOR

OpenAI