Earlier this week, hackers hijacked open source projects used by dozens of companies, pushing updates designed to spread malware. OpenAI confirmed that two employees had their devices compromised, but said there was no evidence that user data or intellectual property was stolen.

The attack is part of a growing trend of supply-chain attacks targeting software developers and their projects. TanStack, a popular open source library, disclosed an attack where hackers published 84 malicious versions during a six-minute window. The malicious updates included malware designed to steal credentials and propagate across systems.

OpenAI said it saw unauthorized access in its internal source code repositories but noted that only limited credential material was taken. As a precaution, the company is rotating digital certificates used to sign products, which will require macOS users to update the app.

The attack highlights the increasing complexity of securing open source projects and the potential for such attacks to compromise multiple targets with just one hack. In March, North Korean hackers hijacked Axios, another popular development tool, pushing malware that could have affected millions of developers.