OpenAI is giving macOS users until June 26, 2026, to update their apps — a year longer than originally announced. This comes after they found a security issue tied to a compromised open-source library called TanStack npm, part of a broader supply chain attack called Mini Shai-Hulud. Two employee devices were hit, leading to some credential theft from internal code repos, but no user data, production systems, or published software was affected. OpenAI has already rotated credentials, isolated systems, and locked down workflows. The extension gives everyone breathing room while they finish updating security certificates to prevent fake apps from masquerading as OpenAI software. Why it matters: This incident highlights how even AI leaders aren’t immune to open-source supply chain attacks, and their transparency here sets a new standard for how tech companies should handle such breaches — proactively communicating risks without panic.