OpenAI Hit by TanStack Supply Chain Attack

Ah, OpenAI, the company that solemnly promises to build safe AGI for all humanity, has just discovered that its own internal security is about as robust as a wet paper bag. In what must be a deeply embarrassing disclosure, the lab admitted that two employee devices were compromised in the TanStack supply chain attack, and—brace yourself—credential material was exfiltrated, including the very code-signing certificates that prove software comes from them. One can almost hear the collective groan from security engineers everywhere.

The TanStack attack, for those not in the know, is a supply chain breach that has already hit several tech firms. But OpenAI's involvement is particularly poetic: an organization that spends millions on safety research, that routinely warns about the existential risks of AI, couldn't even protect its own signing keys. Those certificates are now in the wild, ready to be used to sign malicious code as if it came from Sam Altman himself. It's not quite the AI takeover we were warned about, but it's a damn sight more realistic.

And what's the response? A tepid disclosure that doesn't exactly inspire confidence. Meanwhile, regulators continue to debate the nuances of training data opt-outs while the foundational infrastructure of AI supply chains leaks like a sieve. If this is how the stewards of the future handle their own digital house keys, perhaps we should all go back to using typewriters.