Code execution from a clone: CVE-2025-61260 and the git-config CVEs ran attacker programs with the developer’s privileges before any prompt, which reaches every key and token on the machine.
One machine, every user: Cymulate’s ProgramData finding lets a single standard user set a notify command or weaker sandbox for everyone who runs Codex on that computer.
Tokens that reach beyond the laptop: the BeyondTrust finding exposed the GitHub token Codex used, and PromptArmor showed a malicious email making Codex for Everything send out other emails it was reviewing (PromptArmor).
Exfiltration through trusted domains: Johann Rehberger sent data out of Codex cloud through azure.com, which was on its “Common dependencies” allowlist (Embrace The Red).
Lost work: in openai/codex#42875 a developer reported about 221 GB deleted from their home directory while auto-approved sessions were running; the cause is unconfirmed.
Risks that stay open: Cymulate’s Windows web-search chain was closed as “Not Reproducible”, and the ProgramData issue had no committed fix, so the mitigation is yours to apply.