OpenAI Codex Command Injection Flaw Exposed GitHub Tokens
Security researchers at BeyondTrust Phantom Labs discovered a critical command injection vulnerability in OpenAI's Codex that could allow attackers to steal GitHub OAuth tokens and other sensitive credentials via malicious repository branch names. OpenAI patched the flaw across all affected applications after responsible disclosure.
What happened
BeyondTrust Phantom Labs identified a critical command injection flaw in OpenAI's Codex cloud infrastructure during repository task creation. The vulnerability existed in the branch name parameter, which lacked adequate input sanitization, allowing attackers to embed shell metacharacters directly.
By creating a command injection payload in a malicious branch name, attackers could extract sensitive authentication credentials including GitHub OAuth tokens, OpenAI API keys, and account identifiers. The flaw affected Codex's cloud infrastructure, CLI, SDK, and IDE integration applications.
Reported impact
The vulnerability exposed software developers to widespread GitHub token compromise via malicious repository branch names. This could enable lateral movement and automated credential exfiltration across shared enterprise network repositories.
Adversaries could automate and scale this attack to target multiple developers by generating obfuscated, malicious branches within shared organizational repositories.
Index analysis
As AI agents become more deeply integrated into developer workflows, the attack surface expands. The incident emphasizes escalating AI agent security risks when agents interact with user-controlled inputs without adequate sanitization.
Governance controls
OpenAI fully remediated this critical vulnerability across all affected applications following responsible disclosure by implementing stronger input validation, shell escaping, and token controls.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.