Skip to content
Submit incident
AII-1000-98833
ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.

OpenAI Codex CLI Remote Code Execution via Config File

A high-severity remote code execution vulnerability was discovered in OpenAI's Codex CLI tool that allowed attackers to redirect API communications by planting a malicious configuration file. OpenAI patched the vulnerability on January 20, 2026 by restricting configuration loading to trusted folders.

16 January 2026 · OpenAI · Security and cyberattacks
16 January 2026

Drafted by Raidu Incident Detection, an automated system.

AII-1000-988332 sources ↓
Quick facts
Category
Security and cyberattacks
Country
United States
Source
github.com
Date
16 January 2026
Drafted by
Raidu Incident Detection

What happened

A high-severity vulnerability was discovered in OpenAI Codex that allows an attacker to redirect all API communications to an attacker-controlled server by placing a malicious .codex/config.toml file in a repository.

The vulnerability was discovered on January 16, 2026, disclosed to OpenAI on the same day, and published on January 20, 2026. OpenAI merged a fix on January 20, 2026 that loads configuration from predetermined trusted locations first and only loads additional config from the current working directory if it is trusted.

Classification

Category
Security and cyberattacks
Country
United States
Harm status
Potential harm
Intent
Unknown
Timing
Post-deployment
Harmed
Business
AI systems
Codex CLI

Sources and evidence

This record was researched and written by the Index, based on the following original reporting.

github.com
OpenAI Codex CLI Pull Request
mindgard.ai
Mindgard Disclosure