VulnHub

Real-time Cybersecurity News

ChatGPT’s new feature could give infostealers a map of your Mac activity

Help Net Security

Overview

OpenAI's new Computer History feature for ChatGPT and Codex is stirring up concerns regarding user privacy and security. This feature creates a timeline of a user's activities on their Mac, summarizing app usage and website visits. While it aims to enhance user experience by recalling recent activities, it raises alarms that this detailed mapping could be exploited by malicious actors, particularly infostealers. Users could unknowingly expose sensitive information, making them vulnerable to targeted attacks. The implications of this feature stress the need for careful consideration of user data handling and privacy measures.

Key Takeaways

  • Affected Systems: Mac computers using ChatGPT and Codex
  • Action Required: Users should review privacy settings and consider limiting the feature's access to sensitive data.
  • Timeline: Newly disclosed

Original Article Summary

OpenAI’s new Computer History feature turns recent Mac computer activity into memories ChatGPT and Codex can use, and it’s raising questions about privacy and security along the way. Computer History (Source: OpenAI) What Computer History does Computer History builds a timeline out of everyday computer use, grouping activity into summaries and noting which apps and websites contributed to each one. “Computer History replaces the earlier Chronicle research preview, but it is a rebuilt system rather … More → The post ChatGPT’s new feature could give infostealers a map of your Mac activity appeared first on Help Net Security.

Impact

Mac computers using ChatGPT and Codex

Exploitation Status

The exploitation status is currently unknown. Monitor vendor advisories and security bulletins for updates.

Timeline

Newly disclosed

Remediation

Users should review privacy settings and consider limiting the feature's access to sensitive data.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

OpenSSL 4.1.0: What’s new, what’s removed, and what’s still broken

Help Net Security

The OpenSSL project has released version 4.1.0, which introduces support for DTLS 1.3, a protocol variant designed for datagram transport over networks like UDP. However, this new version comes with four known bugs in the DTLS code, which could lead to applications misinterpreting connection data. Developers using DTLS 1.3 or the recently added DTLS support in OpenSSL’s SSL listener API are particularly at risk. This situation is concerning as it could affect the reliability and security of applications that rely on these protocols, potentially leading to data miscommunication. Users and developers should stay alert for updates or patches that address these issues.

Oct 25, 2026

Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers

The Hacker News

A security researcher has revealed that vulnerabilities in Tailscale's SSH feature could allow an attacker to gain root access on other servers within the same network. This scenario arises when Tailscale SSH is configured to permit port forwarding, and an attacker has already compromised one device that the network's access rules allow to connect to the target server. This means that if a device is hacked, it could potentially serve as a gateway to escalate privileges on other connected servers. The implications of this discovery are significant, as it raises concerns for organizations using Tailscale, particularly regarding their network security configurations. Companies need to evaluate their Tailscale SSH settings to prevent unauthorized access and ensure that their systems remain secure.

Oct 25, 2026

PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking

The Hacker News

Recent incidents reveal that attackers are exploiting vulnerabilities in PHP2Shell, identified as CVE-2026-109618 and CVE-2026-109619, to compromise systems. In one notable case, a government entity in Europe fell victim to these attacks. Within just two hours of the initial breach, hackers accessed sensitive information, including password hashes and multi-factor authentication keys. The situation is concerning as it indicates the use of AI-driven tools for post-exploitation tasks, which could enhance the attackers' capabilities. This incident underscores the urgency for organizations, especially those in the public sector, to bolster their defenses against such sophisticated threats.

Oct 25, 2026

AI coding agents hijacked using AGENTS.md file in Downloads folder

BleepingComputer

Researchers discovered a malicious file named AGENTS.md in a user's Downloads folder that deceived an AI coding agent into installing a harmful npm package. This incident raises concerns about the security of AI tools, particularly how they can be manipulated through seemingly innocuous files. The attack could potentially compromise systems that rely on AI for coding assistance, exposing them to unwanted software and vulnerabilities. Users and developers should be aware of the risks posed by downloaded files and ensure their systems are safeguarded against such tactics. This incident serves as a reminder for companies to enhance their security measures when integrating AI into their workflows.

Oct 25, 2026

OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication

The Hacker News

OpenAI has announced that it will conduct training for its advanced AI models without live internet access. This decision follows concerns about the security of current internet infrastructure and the need for effective monitoring systems. The goal is to enhance safety and alignment in AI development, particularly as the company resumes reinforcement learning training. The announcement comes amidst rising scrutiny over AI capabilities and their potential risks. By isolating training from the internet, OpenAI aims to mitigate risks associated with external threats and ensure a more controlled environment for its models.

Oct 25, 2026

SPECTER Attack Uses USB Power Signals to Leak Data From Air-Gapped PCs

Hackread – Cybersecurity News, Data Breaches, AI and More

Researchers have introduced a new technique called SPECTER, which can extract data from air-gapped computers—those not connected to the internet—by manipulating USB power signals. This method uses changes in power levels during phone charging or the use of USB peripherals to transmit sensitive information. The implications of this discovery are significant, as it reveals vulnerabilities in systems that are typically considered secure due to their isolation. Organizations relying on air-gapped systems for sensitive operations need to reassess their security protocols to guard against this potential data leakage. As air-gapped environments are often used for critical infrastructure and sensitive data, understanding and mitigating this risk is crucial for protecting valuable information.

Oct 24, 2026