ChatGPT Atlas Stores OAuth Tokens Unencrypted Leads to Unauthorized Access to User Accounts
A vulnerability has been identified in OpenAI's ChatGPT Atlas browser, which stores unencrypted OAuth tokens within a SQLite database . This issue arises due to permissive file settings on macOS, potentially allowing unauthorized access to user accounts.
A vulnerability has been identified in OpenAI's ChatGPT Atlas browser, which stores unencrypted OAuth tokens within a SQLite database . This issue arises due to permissive file settings on macOS, potentially allowing unauthorized access to user accounts.
Discovered by Pete Johnson shortly after the browser's release on Sat, Oct 21, 2025, the vulnerability bypasses standard encryption protocols used by other major browsers, thereby exposing sensitive authentication data to any process on the system.
The OAuth tokens are stored without encryption, protected only by 644 file permissions, making them readable by all users and processes on the device. In contrast, established browsers utilize macOS Keychain for token encryption, a step bypassed by Atlas, facilitating straightforward extraction and reuse of tokens via simple scripts.
Pete Johnson demonstrated the potential impact by crafting a local script that queried the database to retrieve unencrypted tokens and successfully accessed the OpenAI API, obtaining user profile details and conversation history.
The lack of encryption poses significant security risks, especially as Atlas is designed as a Chromium-based AI browser that can import bookmarks, passwords, and history. Unencrypted tokens could allow attackers to impersonate users, accessing ChatGPT conversations and potentially linked services if scopes overlap.
A vulnerability has been identified in OpenAI's ChatGPT Atlas browser, which stores unencrypted OAuth tokens within a SQLite database .
The vulnerability persists due to the absence of prompts for Keychain integration during the installation process, a standard practice in secure applications. While macOS user permissions limit cross-account exploitation, intra-account risks remain high, particularly on shared or compromised devices.
Experts recommend immediate updates to address this vulnerability. Users are advised to monitor permissions, enable two-factor authentication on OpenAI accounts, and avoid conducting sensitive tasks using Atlas until the issue is resolved.
OpenAI has emphasized privacy controls in Atlas, such as data training opt-outs and memory management, but the current storage misconfiguration undermines these measures. The rapid rollout of the browser to Free, Plus, and Pro users on macOS, with pending versions for Windows and mobile, underscores the urgency for corrective patches.
As of Sun, Oct 22, 2025, there is no official bug reporting mechanism for Atlas, leaving users awaiting resolution. Discrepancies in the installation process have been noted, with some users reporting Keychain prompts resulting in encrypted tokens, while others do not, indicating a potential rollout bug or A/B testing issue.
For further updates, users are encouraged to follow cybersecurity news outlets and consult OpenAI's security advisories.
Based on reporting by Cyber Security News.