One GitHub Issue Could Have Led to a Poisoned Codex Release, Researchers Say; OpenAI Has Fixed the Bug
Security firm Depi disclosed on November 11 a chain that started with a prompt injection in a GitHub Actions workflow on OpenAI's Codex repository, where any outside user could trigger the Codex agent by opening an issue. Depi says it escaped the agent's sandbox, took workflow tokens, poisoned the repository's build cache and could have obtained the credentials needed to publish a backdoored @openai/codex package on npm. OpenAI fixed the core bug and paid an initial $1,000 bounty with the report still under review, Depi says. No malicious release has been reported.
The weak point was not Codex on a developer's laptop. It was Codex running as a helper inside OpenAI's own release machinery, reading text that anyone on the internet could write. Depi, a software supply-chain security firm, says one crafted GitHub issue was enough to start a chain that ended within reach of the publishing credentials for @openai/codex, the package developers install to run OpenAI's coding agent.
What Depi says it found#
In a write-up published on November 11, Depi researchers Pierre Martin and Garance de la Brosse say the entry point was an Issue Labeler workflow on the openai/codex GitHub repository. The workflow used OpenAI's Codex action to read newly opened issues and suggest labels, and it fed the issue text straight into the agent's prompt. Any external user could trigger it by opening an issue.
From there, by Depi's account:
- A crafted issue made Codex treat the attacker's text as its instructions. Compressing and encoding a script hid its purpose from Codex's guardrails, and the researchers got code execution inside the agent's sandbox, shown in a test repository.
- They escaped that sandbox and read the workflow's tokens from memory on the GitHub runner.
- With those tokens they planted a poisoned entry in the repository's build cache, which a more privileged workflow restores without checking it.
- A final step would trick a maintainer into handing over a token that npm trusts for publishing, which Depi says would have allowed a malicious version of Codex to be published.
Depi says the package is downloaded millions of times a month and argues the stakes are higher than for an ordinary library, because a coding agent "is designed to execute code" on machines that hold developer credentials.
The fix and the bounty#
Depi says it reported the chain with a full proof of concept through OpenAI's Bugcrowd program, that OpenAI "deployed a fix right away," and that OpenAI has fixed the core bug, so users have nothing to patch. OpenAI awarded an initial $1,000 bounty and the report is still under review, according to Depi. Earlier this month OpenAI said critical Codex flaws now pay up to $30,000, with exceptional ones eligible for more.
The Defiant, reporting on the disclosure, notes that it does not report a malicious npm release reaching users. Depi's own advice is behavioural: put a short cooldown on tools that update themselves automatically, so others can spot a bad release first. It is the same lesson as Railway's breach, where stored AI keys were the prize: the risk sits in the automation around AI tools as much as in the models.
Limits#
- Every step of the chain is Depi's account. We found no public statement from OpenAI describing the flaw or confirming the impact Depi describes.
- Depi does not say when it reported the issue or when the fix shipped.
- The final publishing step depended on a maintainer acting on a planted release; Depi describes the path, not a completed malicious publication.
- The $1,000 figure is an initial award; Depi says the final assessment is pending.