OpenAI says hackers stole some data after latest code security issue

The company stated that no user data or production systems were accessed during the incident. OpenAI disclosed the breach in a blog post, though the specific data stolen has not been detailed. The attack was discovered as part of routine security monitoring.

The attack exploited a vulnerability in the TanStack library, which is widely used for building user interfaces. OpenAI's incident response team detected the compromise and took steps to secure affected devices. The company said it has found no evidence that the attackers leveraged the employee device compromise to move laterally into core systems or access customer information. OpenAI has notified relevant law enforcement authorities.

Supply chain attacks targeting open-source libraries are a growing concern across the tech industry, with incidents affecting major companies in recent years. OpenAI's disclosure follows a pattern of increased transparency around security incidents among AI labs, though some security researchers have questioned the timing and extent of the disclosure. The company has not indicated whether the attackers were state-sponsored or financially motivated, and has not specified what data, if any, was exfiltrated from the compromised devices.