AI SECURITYLABS

Security for Codex Development: It wasn't a one-off

Part 5 of 17

It wasn’t a one-off

  • Git settings that run programs: the desktop app ran an attacker program through a repository’s .git/config when a workspace was opened (CVE-2026-19593), and related CVEs used core.hooksPath and core.fsmonitor.
  • Approval skipped by a parser: Codex misread PowerShell’s stop-parsing token --%, so a prepared repository could run a file-writing git command without approval (CVE-2026-19591, fixed in CLI 0.131.0).
  • One user configuring everyone: on Windows, Codex loads machine-wide defaults from a ProgramData folder that isn’t locked by default; Cymulate reported it unresolved at publication (Cymulate).
  • A branch name that stole a token: BeyondTrust Phantom Labs injected commands into Codex cloud through a crafted branch name, exposing the GitHub token Codex used (The Hacker News).
  • An approver that approves malware: a hidden comment in a GitHub issue got Codex’s auto-review agent to approve a malicious npm install (PromptArmor).