The incident: CVE-2025-61260
Check Point Research found that Codex CLI loaded a project’s .env and .codex/config.toml without asking. A .env could point CODEX_HOME into the repository, and the MCP servers declared there then started as soon as Codex ran, with no confirmation (Check Point; GitHub advisory).
Nobody had to type a prompt or approve a tool: running Codex in the repository was enough. Check Point reported it fixed in Codex 0.23.0 on August 20, 2025, and it was later scored 9.8 (CVSS 3.1, by CISA-ADP).