ChatGPT's macOS App Stored Your Conversations in Plaintext

In July 2024, the developer Pedro José Pereira Vieito noticed something about OpenAI's ChatGPT app for macOS: it stored users' conversations locally in plaintext, in a location any other app on the machine could read. As first reported by The Verge, it was not a sophisticated exploit — it was a design oversight that undid the operating system's own protections.

The subtlety is in why the files were reachable. Apps distributed through the Mac App Store run inside Apple's App Sandbox, which walls their data off from other applications. OpenAI distributed the ChatGPT app directly from its own website, so it was not bound by that sandboxing requirement — and it stored conversation history in an unprotected location without adding encryption of its own.

Why that is a real problem

On a modern Mac, a user reasonably assumes one app cannot rifle through another's data. Here, any process running as the user — a second app, a malicious script, commodity infostealer malware — could read the full ChatGPT history without prompting for permission. Pereira Vieito built a small proof-of-concept app that simply displayed the conversations in its own window to make the point concrete.

A fast, clean fix

After The Verge contacted OpenAI, the company shipped an update that encrypts the locally stored conversations, and the proof-of-concept stopped working. There was no CVE — this was application behaviour rather than a catalogued vulnerability — and the resolution was quick. Credit where due: responsible disclosure met a prompt fix. But the episode is a useful reminder that AI clients accumulate unusually sensitive local data by default.

It also underscores how much confidential information now lives in chatbot histories. The threat model for an AI desktop client is not only the network path to the provider; it is the data at rest on the endpoint, and the other software sharing that endpoint.

The broader shift worth naming is that AI has created a new category of high-value local data almost overnight. A few years ago, the most sensitive thing on a typical laptop was a browser's saved-password store, which is why infostealer malware evolved to target it. Conversation histories with AI assistants now belong in the same tier: they routinely contain the exact material — internal code, unreleased plans, credentials pasted for debugging — that an attacker would otherwise have to work to assemble. Unlike a password vault, users have little instinct that a chat log is sensitive, so they neither clear it nor think about where it lives. Data-loss-prevention tooling tuned to catch files and attachments may be blind to a plaintext database of chatbot conversations sitting in an application-support directory.

What defenders should take away

• Encrypt AI conversation data at rest. Whether you build or buy an AI client, local history should be encrypted and access-controlled, not left in plaintext for any process to read.
• Do not rely on assumptions the platform is not enforcing. A directly distributed app is outside App Store sandboxing; if you ship one, replace that protection deliberately.
• Account for local secrets in DLP and endpoint monitoring. Infostealers already hunt for browser and app data; AI chat histories are a rich new target.
• Know which AI clients are installed. Unmanaged desktop AI apps are shadow endpoints holding sensitive conversation data you have not inventoried.

The ChatGPT macOS issue was small in mechanism and large in implication: the most sensitive thing about an AI tool is often the pile of conversations it quietly keeps. Managing that risk begins with knowing which AI applications your people have installed and what they store — because you cannot defend what you have not discovered.