At a glance
Critical 4 High 13 Medium 7
Severity reflects how directly a misconfiguration leads to credential theft, loss of production data or a supply-chain compromise. Audit check gives the Codex Security Audit checks that detect it; "manual" means review it by hand.
The misconfigurations
Full access (danger-full-access, --yolo) on a laptop, or through a shell alias.
Why it matters. Full access removes the sandbox and every approval. In openai/codex#42875 a developer reported about 221 GB deleted from their home directory while auto-approved Codex sessions were running; the cause is unconfirmed.
Fix. Use a permission profile that extends :workspace. Keep full access for disposable containers, and remove any alias that adds it.
Trusting a repository without reading its .codex/ folder, AGENTS.md and .env.
Why it matters. Check Point showed Codex CLI loading a project .env that pointed CODEX_HOME into the repository, so its MCP servers ran on open without confirmation (CVE-2025-61260, CVSS 3.1 9.8 by CISA-ADP, fixed per Check Point in 0.23.0).
Fix. Review those files before trusting a project, open unknown code in a container or Codex cloud, and keep Codex current.
approval_policy = "never", or the retired "untrusted".
Why it matters. "never" runs every command unattended. "untrusted" was retired in Codex 0.149.0 (PR #39630), and OpenAI's docs warn that the retired setting can prevent the client from starting (Codex docs).
Fix. Set approval_policy = "on-request" everywhere, including profiles and scripts.
Command network access on without the proxy, or with a broad allow list.
Why it matters. A profile's network.enabled = true permits direct network access; the domain rules only restrict it when the network proxy is running (Codex docs).
Fix. Keep network off by default; when a task needs it, set [features] network_proxy = true and allow only the registries you use.
Nothing keeps .env files and credential folders unreadable.
Why it matters. In workspace-write mode the agent can read files and edit within the workspace (Codex docs): reads aren't limited to the workspace.
Fix. Deny **/.env*, ~/.ssh, ~/.aws and other credential folders in your permission profile; organisations can enforce [permissions.filesystem] deny_read.
On Windows, C:\ProgramData\OpenAI\Codex missing or writable by standard users.
Why it matters. Cymulate reported that Codex loads machine-wide defaults from that folder, which isn't created or locked by default, so one standard user can plant a notify command or weaker sandbox for every user on the machine; OpenAI had not committed to a fix at publication (Cymulate).
Fix. Create the folder as an administrator before deploying Codex, remove write access for Users, and alert on changes to it.
Web search on native Windows, or web_search = "live" anywhere.
Why it matters. Cymulate chained a prompt injection in a web page with a planted node.bat picked up by Windows PATH resolution to run code outside the sandbox; OpenAI closed the report as "Not Reproducible" (Cymulate).
Fix. Set web_search = "disabled" on native Windows and "cached" elsewhere; don't use --search for routine work.
Codex CLI, desktop app or IDE extension not updated.
Why it matters. Fixes ship in releases: a model-generated working directory could become the sandbox's writable root (CVE-2025-59532, fixed in 0.39.0), and a PowerShell parsing bug skipped approval to run a file-writing git command (CVE-2026-19591, CVSS 3.1 8.8 by CISA-ADP, fixed in CLI 0.131.0). Plugin4Shell let a plugin pinned by commit be swapped on background auto-update, which is on by default in Codex (AIR Security, fixed in 0.146.0). Codex has no setting that enforces a minimum version.
Fix. Update the CLI, desktop app and IDE extension together, and track OpenAI's advisories.
Opening a repository that arrived with its own .git/config.
Why it matters. The desktop app ran an attacker program through a repository's attr.tree and a filter driver when the workspace was opened (CVE-2026-19593, CVSS 3.1 9.8 by CISA-ADP); related CVEs used core.hooksPath and core.fsmonitor. A normal git clone never copies .git/config.
Fix. Re-clone repositories you received as archives or folders, or remove program-running keys from .git/config first; keep Codex current.
Unvetted MCP servers, or servers that read content outsiders can write, with no approvals.
Why it matters. Fake Sentry error events carrying "fix" instructions hijacked Claude Code, Cursor and Codex through an MCP server (Agentjacking, The Hacker News).
Fix. Keep an approved, pinned server list; use enabled_tools; give outsider-content servers read-only scopes and default_tools_approval_mode = "prompt".
Auto-review treated as a security boundary.
Why it matters. PromptArmor used a hidden comment in a GitHub issue to get Codex's auto-review agent to approve a malicious npm install that ran outside the sandbox; OpenAI says the reviewer "can still make mistakes" (PromptArmor).
Fix. Keep a person approving sensitive work (approvals_reviewer = "user"), and keep the sandbox and rules underneath auto-review.
No command rules, or rules that allow shells, deletes or network tools.
Why it matters. An allow rule runs matching commands outside the sandbox without asking, and a rule with no decision is an allow rule (Codex docs).
Fix. Add prompt rules for git push, publishing and infrastructure tools and a forbidden rule for recursive deletes; state every decision.
Hooks or notify commands from someone else, or --dangerously-bypass-hook-trust.
Why it matters. Hooks and notify run commands with your privileges on every matching event. Codex runs a non-managed hook only after you trust its exact definition, unless the bypass flag is used (Codex docs).
Fix. Review each hook with /hooks before trusting it; organisations can set allow_managed_hooks_only.
Codex cloud environments with unrestricted internet access, or a broad preset domain list.
Why it matters. Johann Rehberger exfiltrated data from Codex cloud through azure.com, which was on the 71-domain "Common dependencies" allowlist; OpenAI closed the report as not applicable (Embrace The Red).
Fix. Keep agent internet access off; if a task needs it, allow only the domains it uses, never "All (unrestricted)" (see the Codex cloud docs).
Broad GitHub access for Codex cloud, and no branch protection.
Why it matters. BeyondTrust Phantom Labs found that a crafted GitHub branch name injected commands into Codex cloud task containers, exposing the GitHub user access token Codex used; OpenAI fixed it (The Hacker News).
Fix. Connect only the repositories Codex needs, protect branches so Codex can open pull requests but not merge, and treat repository metadata as untrusted.
Connectors that bring in outside content (email, files, web) enabled with command network on.
Why it matters. A malicious email made Codex for Everything exfiltrate the full contents of other emails it was reviewing through a zero-click image request; OpenAI remediated it (PromptArmor).
Fix. Enable outside-content connectors only where the task needs them, and keep command network off in those sessions.
An out-of-date Codex desktop app on macOS.
Why it matters. Before 26.527.31326 the desktop app fetched remote Markdown images automatically, so an injected response could send session data to an attacker's server without a click (CVE-2026-14898, CVSS 3.1 6.5 by CISA-ADP).
Fix. Keep the desktop app updated; organisations can block unknown image hosts at the proxy.
Skills allowed to install their MCP dependencies automatically (the default).
Why it matters. skill_mcp_dependency_install is on by default, so a skill can install and start MCP servers you never reviewed (Codex docs).
Fix. Set [features] skill_mcp_dependency_install = false and install servers yourself after review.
Memories allowed from web search and MCP content (the default).
Why it matters. memories.disable_on_external_context defaults to false (Codex docs), so injected text can persist into later sessions.
Fix. Set [memories] disable_on_external_context = true.
Credentials in files: the CLI credential store, MCP env blocks, or secrets exported from shell startup files.
Why it matters. Anything a hijacked command can read, it can send on. Login shells are allowed by default, so commands load ~/.bashrc and ~/.zprofile (Codex docs).
Fix. Use the keyring stores, allow_login_shell = false, and env_vars or bearer_token_env_var for MCP secrets.
Non-interactive runs (codex exec, CI) with full access or ambient credentials on shared runners.
Why it matters. Automation has no one to approve anything, so the sandbox and credentials in reach are the only boundary (Codex non-interactive docs).
Fix. Run each job in its own container with a read-only or workspace profile, an egress allow list and only the credentials the job needs.
Custom harnesses and relays that trust any process that looks like Codex.
Why it matters. @ai-sdk/harness-codex before 1.0.29 authorised any process whose command line contained the Codex CLI shim path, so code in the sandbox could call host tools (CVE-2026-64650, CVSS 4.0 6.3).
Fix. Update SDK harnesses and audit any relay that authorises callers by process path.
Organisations relying on users' own config.toml instead of managed requirements.
Why it matters. Only requirements.toml settings are enforced; users can change their own config at any time (Codex managed configuration).
Fix. Deploy managed requirements, like the file below, from Agent Security, MDM or an admin-owned file.
No telemetry.
Why it matters. Codex telemetry is off by default (Codex docs), so incidents are found by the people they happen to rather than by defenders.
Fix. Configure the [otel] exporter to your collector, and keep raw prompts out unless your policy approves them.
Fix order
Work through them in this sequence, finishing each step before starting the next:
- Stop the worst exposure: X1, X2, X6, X8, X14. End full access on laptops, stop trusting repositories unread, lock the Windows ProgramData folder, update everything, and close cloud internet access.
- Contain the agent: X3, X4, X5, X7, X12, X13, X21. Approvals on, network through the proxy, secrets denied, web search cached or off, rules and hooks under control, and automation in containers.
- Govern extensions and access: X9, X10, X11, X15, X16, X18, X23. Vet repositories, MCP servers, connectors and skills; scope GitHub access; deploy managed requirements.
- Close the rest: X17, X19, X20, X22, X24. The remaining items, then re-run the audit against your new baseline.
One managed requirements file
For organisations, this example requirements.toml enforces the settings behind X1, X3, X12, X13 and X23, and most of X5, on local Codex clients (CLI, IDE extension and desktop app) whose version supports each key; users can't weaken requirements from their own config. It doesn't govern Codex cloud environments. Two limits: on native Windows, managed deny_read covers direct file tools but not shell reads, and X7 needs allowed_web_search_modes = ["disabled"] on Windows fleets. Replace the placeholders and check every key against the managed configuration docs for the Codex versions you run.
# requirements.toml: settings no Codex user can weaken. Deliver it from Agent
# Security in the ChatGPT admin console, macOS MDM, /etc/codex/requirements.toml
# or %ProgramData%\OpenAI\Codex\requirements.toml. Check each key against the
# managed configuration docs for the Codex versions you run.
allowed_approval_policies = ["on-request"]
allowed_sandbox_modes = ["read-only", "workspace-write"] # clients before 0.138.0
allowed_web_search_modes = ["cached"] # "disabled" is always allowed;
# use ["disabled"] for Windows fleets
allowed_approvals_reviewers = ["user"]
allow_managed_hooks_only = true
# Codex 0.138.0 and later: permission profiles. Full access is left out, so it's denied.
default_permissions = ":workspace"
# Authentication pins apply from the local file or macOS MDM only.
allowed_login_methods = ["chatgpt"]
allowed_chatgpt_workspaces = ["00000000-0000-0000-0000-000000000000"]
[allowed_permission_profiles]
":read-only" = true
":workspace" = true
[permissions.filesystem]
# On native Windows this covers direct file tools only, not shell reads.
deny_read = ["/**/.env", "/**/.env.*", "/**/*.env", "~/.ssh", "~/.aws"]
[features]
browser_use = false
computer_use = false
[rules]
prefix_rules = [
{ pattern = [{ token = "rm" }], decision = "forbidden", justification = "Delete files yourself if you mean it." },
{ pattern = [{ token = "git" }, { any_of = ["push"] }], decision = "prompt", justification = "Review before publishing code." },
{ pattern = [{ any_of = ["bash", "sh", "zsh"] }], decision = "prompt", justification = "Require explicit approval for shell entry points." },
]
# Only these MCP servers can be enabled. An empty [mcp_servers] table disables all.
[mcp_servers.docs]
identity = { url = "https://mcp.example.com/mcp" }Sources
- OpenAI Codex documentation: Configuration reference, Agent approvals and security, Permission profiles, Rules, Hooks, Managed configuration.
- Incidents and research: Check Point, CVE-2025-61260 · OpenAI, CVE-2025-59532 · NVD, CVE-2026-19591 · NVD, CVE-2026-19593 · NVD, CVE-2026-14898 · Vercel, CVE-2026-64650 · BeyondTrust finding (The Hacker News) · Cymulate, Windows web search chain · Cymulate, ProgramData configuration · Embrace The Red, Codex cloud allowlist · PromptArmor, Codex for Everything · PromptArmor, auto-review · Agentjacking · AIR Security, Plugin4Shell · openai/codex#42875 · openai/codex PR #39630
Informational only, with no guarantee of a vulnerability-free setup, so test every configuration in your own environment. AISecurityLabs.org is independent and not affiliated with OpenAI.