Breachesby GlyphOpenAI
Disclosed May 14, 2026Unverified
TanStack npm supply chain attack reached two OpenAI employee devices and internal repos
OpenAI said two employees' devices were compromised in the Mini Shai-Hulud supply chain campaign attributed to TeamPCP, with credential-focused exfiltration from a limited set of internal source repositories. It rotated code-signing certificates and said customer data and production systems were not affected.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | May 14, 2026 |
| Attack | Supply chain |
| Data exposed | Credentials and tokensSource code |
| Sector | AI · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
| Part of | Tanstack (2026) |
Sources
Notices filed
Same campaign
Other breaches at OpenAI
Researchers used Claude to chain bugs and take over OpenAI employee ChatGPT accountsHacking exposed credentials and tokens, prompts and chats and internal documents.HackingAIUSUnverifiedSep 17Mixpanel analytics vendor breach exposed limited data on OpenAI API usersVendor breach exposed names, emails and location data.Vendor breachAIUSUnverifiedNov 26, 2025Shared ChatGPT conversations were indexed by Google and other search enginesExposed data exposed prompts and chats and messages.Exposed dataAIUSUnverifiedJul 31, 2025Artists leaked early access to OpenAI's Sora video model on Hugging FaceInsider exposed API keys.InsiderAIUSUnverifiedNov 26, 2024Hacker accessed OpenAI internal employee discussion forum in 2023Hacking exposed messages and internal documents.HackingAIUSUnverifiedJul 5, 2024Hijacked ChatGPT account exposed strangers' chats containing portal passwordsExposed prompts and chats and credentials and tokens.AIUSUnverifiedJan 30, 2024ChatGPT Redis bug exposed chat titles and Plus subscriber payment detailsExposed data exposed names, emails, addresses, payment cards and prompts and chats.Exposed dataAIUSMar 24, 2023
History of this record
OpenAI said two employee devices were compromised in the Mini Shai-Hulud TanStack npm supply-chain attack, exposing limited credentials from internal code repositories and code-signing certificates, which it rotated. It found no customer da to OpenAI said two employees' devices were compromised in the Mini Shai-Hulud supply chain campaign attributed to TeamPCP, with credential-focused exfiltration from a limited set of internal source repositories. It rotated code-signing certifiby seedSource
OpenAI says TanStack supply-chain attack hit employee devices and signing certs to TanStack npm supply chain attack reached two OpenAI employee devices and internal reposby seedSource
First recordedby seedSource
First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.