OpenAI Codex Security Flaws Expose Enterprise Agent Risks

A string of Codex vulnerabilities

OpenAI has spent recent months presenting Codex as a tool ready for enterprise software teams. Security researchers have spent the same period finding ways the coding agent can be turned against the developers who run it. Three separate disclosures describe different flaws in different parts of the product, but they share a pattern. In each case, Codex trusted input it should have treated with suspicion, and that trust could be converted into command execution or stolen credentials.

The enterprise pitch was explicit. At DevDay 2025, OpenAI positioned Codex as enterprise-ready, cited a 70% productivity boost, and added more advanced code review features 5. Around the same time, the company expanded Model Context Protocol (MCP) support in ChatGPT's developer mode, a capability that coverage at the time called "powerful but dangerous" 5. The disclosures that followed suggest that warning applied to Codex as well.

Flaw one: configuration files that execute themselves

Researchers Isabel Mill and Oded Vanunu identified a command injection bug in the Codex CLI, tracked as CVE-2025-61260 and rated 9.8 on the CVSS scale 1. The problem was in how the CLI handled project-local configuration. When a developer ran Codex inside a repository, the tool automatically loaded and executed MCP server entries defined in that project's config. It did not ask for approval, did not perform a secondary check, and did not re-validate when those values changed 1.

The attack path is short. Anyone with write access to a repository, or the ability to land a pull request, could plant malicious entries that would run on the machine of any developer who later invoked Codex in that project 1.

Flaw two: a branch name that leaked GitHub tokens

BeyondTrust's Phantom Labs found a different injection point in cloud-hosted Codex. Researcher Tyler Jespersen reported that the GitHub branch name parameter in the task-creation request was not properly sanitized. An attacker could hide shell commands in a branch name and have them run inside the agent's container during environment setup 23. The researchers used this to extract the GitHub token Codex uses to authenticate. They exposed it through task output or outbound network requests 23.

The Hacker News described the impact as potentially spanning multiple users who work with a shared repository 2. SiliconANGLE focused on the enterprise risk. Organizations often grant Codex broad permissions across repositories and workflows, so a stolen token could let an attacker move laterally inside GitHub 3. SiliconANGLE also reported that the issue was not confined to the web interface and reached Codex's CLI, SDK and IDE integrations 3. The Hacker News framed the finding alongside a separate ChatGPT data-exfiltration fix and reported that OpenAI had patched both 2.

Flaw three: AGENTS.md as an attack vector

Backslash Security examined Codex CLI's non-interactive "exec" mode, which is built for unattended automation. The researchers found that Codex would follow attacker-written instructions placed in a project's AGENTS.md file before it handled the user's actual request 4. In their testing, this silently staged AWS and npm credentials without any prompt to the user 4. Backslash classifies the issue as indirect prompt injection delivered through an implicitly trusted configuration file. In its view, the root cause is a missing trust boundary in an agent that runs with the developer's full ambient access 4.

Why this matters

The three reports differ in mechanism. One is classic input sanitization, one is automatic execution of configuration, and one is prompt injection. Each also targets a different surface: the local CLI, the cloud agent, and headless automation. That spread is the key point. These look less like isolated bugs and more like the predictable result of an architecture where an agent reads repository contents, executes shell commands, and holds powerful credentials, with little separation between those three things.

The sources also show a gap between the sales message and the threat model. The enterprise case for Codex depends on autonomy: agents running unsupervised, connected to many repositories, with broad tokens 345. Those same properties are what turn a poisoned config file or a crafted branch name into an organization-wide incident rather than an inconvenience on one laptop.

The practical conclusion for security teams is to treat repository-controlled files such as MCP configs and AGENTS.md as untrusted code. They should also scope agent tokens tightly and be wary of fully unattended modes until vendors enforce clearer trust boundaries. OpenAI's fixes for individual flaws are necessary. The broader cost of putting autonomous agents into enterprise pipelines is a design problem, and patches alone will not resolve it.