OpenAI rotates Mac signing material after the Axios supply-chain compromise
A compromised Axios dependency ran inside an OpenAI macOS signing workflow that used a floating package tag. OpenAI reported no evidence of user-data or product compromise, treated the signing material as compromised, rotated it and issued updated ChatGPT, Codex and Atlas builds.
Why it matters: An agent company with strong model controls was still exposed through an ordinary software dependency and CI configuration. The surrounding build system remains part of AI-product security.