OpenAI Codex security
OpenAI's coding agent: the Codex CLI, IDE extension and cloud agent.
The Injection has tracked 4 security stories affecting OpenAI Codex since September 17, 2026 (supply chain 1, benchmark 1, research 1, vulnerability 1), 2 rated high or critical. The most recent, disclosed October 9, 2026, is "OpenAI Sesame: an official skill sent app tokens to an unowned domain".
4
Stories
2
High or critical
0
With a CVE
2026-10-09
Latest disclosure
Every OpenAI Codex story
HIGH
Supply chain · AIR Security
OpenAI Sesame: an official skill sent app tokens to an unowned domainOpenAI Sesame is a flaw in render-deploy, an official OpenAI skill that told coding agents Render private services sit at render-internal.com, a domain Render did not own. AIR Security registered it and received live bearer tokens.
INFO
Benchmark · arXiv
HarnessSecurity-Bench: auto-approve lifts attack success to 95.6%HarnessSecurity-Bench tests nine security mechanisms across six coding agent harnesses and reports that enabling auto-approve raises attack success from 29.2% to 95.6%, while command denylisting cut attack effects with a utility gain.
MED
Research · arXiv
Explosive prompts: dormant injections fire on 'thanks' in agentsExplosive prompts are dormant prompt injections that wait for a harmless trigger such as 'thanks'. A new paper reports 43% to 83% success on nine production agents, versus at most 3% for plain injections, and proposes the DeFuse detector.
HIGH
Vulnerability · AIR Security
Plugin4Shell: zero-click plugin RCE in four AI coding agentsPlugin4Shell is a zero-click remote code execution flaw in how Claude Code, Codex, GitHub Copilot and Gemini CLI install pinned plugins. AIR says Claude Code and Codex are fixed, Copilot is not, and Gemini CLI will not be patched.
Questions people ask
- Does OpenAI Codex have known security vulnerabilities?
- The Injection has tracked 4 stories about OpenAI Codex, none of them with a published CVE yet. Several cover attacks or research that apply to it; each story lists what to do.
- What is the latest OpenAI Codex security issue?
- The most recent story is "OpenAI Sesame: an official skill sent app tokens to an unowned domain" (high severity), disclosed October 9, 2026 by AIR Security. OpenAI Sesame is a flaw in render-deploy, an official OpenAI skill that told coding agents Render private services sit at render-internal.com, a domain Render did not own. AIR Security registered it and received live bearer tokens.
- Which attack techniques have been used against OpenAI Codex?
- Stories about OpenAI Codex on The Injection most often involve coding agents, agent skills, credential theft, prompt injection. Each technique has a glossary entry with a definition and every related story.