AI SECURITYLABS

Security for Codex Development: Check a repository before you trust it

Part 12 of 17

Check a repository before you trust it

Codex loads a project’s .codex/ folder only after you trust the project, then applies it to every session there. Before trusting a repository you didn’t create:

  • Read .codex/config.toml, .codex/hooks.json, .codex/rules/ and AGENTS.md, and stop at any MCP server, hook or allow rule you didn’t write.
  • Check the project .env for CODEX_* variables, the pattern behind CVE-2025-61260.
  • Re-clone repositories that arrived as archives or shared folders, since only those carry their own .git/config.
  • List every symlink and its target: a harmless name pointing at .codex/ or a dotfile is an attack.
  • Open code you don’t trust in a container or Codex cloud, never on a machine that holds your credentials.