AI SECURITYLABS

Security for Codex Development: What goes wrong

Part 3 of 17

What goes wrong

Most serious findings against Codex fall into two groups: files it trusts when it loads, and parsers that misjudge which commands are safe. The main risks are:

  • Repository configuration: a project ships .codex/config.toml, MCP servers, hooks, rules or an AGENTS.md that run or approve things you never chose.
  • Turned-off protections: --yolo, full access or approval_policy = "never" on a machine that holds credentials.
  • Secret exposure: the agent reads .env files or credential folders and sends them out over the network or through a tool.
  • Injected instructions: web pages, issues, emails and MCP output steer the agent.
  • Extension supply chain: MCP servers, plugins and skills are third-party code running with your rights.
  • Platform gaps: Windows-specific paths and parsers that behave differently from Linux and macOS.