OpenAI TanStack 2026 Data Breach

OpenAI's official “Our response to the TanStack npm supply chain attack” advisory directly confirms two affected corporate employee devices, unauthorized access in limited internal repositories, and credential-focused exfiltration. The company conducted a forensic investigation with a third-party incident-response firm, isolated the relevant accounts and devices, and published clear boundaries for the affected data.

BleepingComputer and The Hacker News independently reported the company disclosure, corroborating the two devices, limited credential transfer, unaffected customer and production areas, and precautionary code-signing certificate rotation. Both reports connect the event to the broader Mini Shai-Hulud campaign.

The Mini Shai-Hulud campaign injected malicious code into release flows for TanStack and other open-source projects to collect secrets from developer environments. The payload searched for developer access such as GitHub and npm tokens, cloud credentials, Kubernetes secrets, SSH keys, and environment files. Use of trusted packages and normal distribution channels allowed it to propagate quickly to downstream organizations.

OpenAI observed activity on two employee devices consistent with the malware's publicly documented behavior. Unauthorized access and credential-focused exfiltration occurred in a limited subset of internal source-code repositories available to those employees. The incident date is based on the earliest technical activity that can be verified from public sources.

The confirmed data category is limited credential material successfully transferred from internal source-code repositories. OpenAI separated repository access from actual exfiltration by stating that no other information or code was affected.

The affected repositories also contained code-signing certificates used for OpenAI products on iOS, macOS, and Windows. The company found no evidence that the certificates had been used to sign malicious software, but revoked and replaced them to remove potential risk. Certificates are described as potentially exposed, not as credentials with confirmed malicious use.

OpenAI confirmed that customer or user data was unaffected, production systems were not accessed, and deployed software was not modified without authorization. Intellectual property was also excluded from the compromised-data scope. The affected-person or record count published by the official source represents the reported scope of the incident. It does not mean that every disclosed data category applied to every person.

The company found no evidence that the limited stolen credential material was used in follow-on attacks. It isolated impacted systems and identities, revoked user sessions, rotated all credentials across affected repositories, temporarily restricted deployment workflows, and audited user and credential behavior. These actions form the verified containment boundary that kept the incident from progressing into production.

After replacing certificates, OpenAI asked macOS users of ChatGPT Desktop, Codex App, Codex CLI, and Atlas to update before June 12, 2026. Once the old certificates were revoked, Apple's notarization controls could block new downloads or launches signed with the previous certificate. This required user action does not indicate that customer data was stolen.

Windows and iOS users did not need to take incident-related action. OpenAI's broad rotation of macOS, Windows, iOS, and Android signing material was precautionary; the company did not detect a fake OpenAI application signed with the exposed certificates.

The affected-person or record count published by the official source represents the reported scope of the incident. It does not mean that every disclosed data category applied to every person. Two devices and two employees describe the same verified scope; repository, certificate, and malicious-package counts are not added to the number of people.

Readers should understand the verified event as two employee devices, limited internal-repository access, and exfiltration of limited credential material. Customer data, production systems, intellectual property, and deployed software were unaffected, and no certificate abuse was detected. If new forensic findings are published, the data categories and scope can be reassessed against original sources.