OpenAI confirms limited data theft after supply chain attack tied to TanStack malware updates

Only employee code repos were hit, OpenAI says

OpenAI says hackers stole limited credential data from a small subset of internal source code repositories accessed by two employees, after a supply chain attack affected their devices. The company reports no evidence that user data, production systems, intellectual property, or existing software installations were compromised. OpenAI traces the incident to an earlier TanStack open source breach, where attackers published 84 malicious software versions over a six-minute window. OpenAI is rotating signing certificates as a precaution, requiring macOS updates.