OpenAI confirms security breach in TanStack supply chain attack, but says no user data was affected

A file and folder transferring data with a red warning mark indicating malware.

• OpenAI confirmed two employee devices were impacted in the TanStack “Mini Shai‑Hulud” supply chain attack
• Malware exfiltrated limited credential material from internal code repositories; no customer data or IP affected
• OpenAI revoked sessions, rotated credentials and signing certificates; macOS users must update apps, Windows/iOS unaffected

OpenAI has confirmed two employee devices were affected by the recent TanStack supply chain attack, but stressed the incident left almost no mark on its operations.