OPEN LINK ↗
// 45d agoSECURITY INCIDENT
OpenAI flags Codex App in Axios incident
OpenAI says it identified a security issue involving the third-party Axios library as part of a broader industry supply-chain incident. The company says there is no evidence that OpenAI user data was accessed, its systems were compromised, or its software was altered, but it is rotating macOS signing material and asking users to update to the latest versions of its apps, including Codex App.
// ANALYSIS
Hot take: this is a trust-and-distribution incident more than a product flaw, and OpenAI is responding like a company that wants to get ahead of any downstream confusion about app authenticity.
- –The incident appears to have hit the macOS app-signing workflow, not the product itself.
- –OpenAI says the malicious Axios payload ran in a GitHub Actions process, which is a classic supply-chain blast radius problem.
- –The company is treating the signing certificate as compromised out of caution, even though it found no evidence of misuse.
- –The update pressure is real: older macOS builds may stop receiving support or functioning after the revocation window.
- –The message is also a user-safety play: only update via in-app updates or official OpenAI links.
// TAGS
openaicodexsecuritysupply-chainaxiosmacosapp-signing
DISCOVERED
45d ago
2026-04-16
PUBLISHED
50d ago
2026-04-11
RELEVANCE
10/ 10
AUTHOR
OpenAI