Case codex-branch-name-injectionAgent hijackUnited States
OpenAI Codex branch-name command injection exposed GitHub tokens in cloud tasks
BeyondTrust found Codex did not sanitise the GitHub branch name when cloning repos, so a crafted request could run shell commands in the task container and steal the GitHub token. OpenAI fixed it on 5 February 2026.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Mar 31, 2026
- Location
- United States
- Target
- OpenAI Codex (web, CLI, SDK, IDE extension)
- Severity
- High
- Triggered by
- BeyondTrust Phantom Labs
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
BeyondTrust found Codex did not sanitise the GitHub branch name when cloning repos, so a crafted request could run shell commands in the task container and steal the GitHub token. OpenAI fixed it on 5 February 2026.
Impact: Token theft and lateral movement across shared repositories was possible; no exploitation reported
Who triggered it
Actor: BeyondTrust Phantom Labs
Attribution: Reported to OpenAI on 16 December 2025; fixed before disclosure
Motive: Security research
How it happened
Attack vector: Command injection via unvalidated branch name parameter, with Unicode obfuscation to hide the payload in the UI
Root cause: Shell command construction from untrusted input in the Codex task runner
Timeline
- BeyondTrust reports the flaw
- OpenAI patches input validation
- Public disclosure
Response
OpenAI tightened branch-name validation and hardened command construction
Current status: Patched
Sources (open in a new tab)
- CSO Online csoonline.com
- Hackmag hackmag.com
Cite this case
OpenAI Codex branch-name command injection exposed GitHub tokens in cloud tasks. AI Threat Watch, case codex-branch-name-injection, Mar 31, 2026. https://aithreat.io/cases/codex-branch-name-injection/
Permanent link: https://aithreat.io/cases/codex-branch-name-injection/