Prompt injection reached the official Codex npm pipeline

Security firm Depi turned a single prompt injection in OpenAI’s Codex into control over the pipeline that publishes the official @openai/codex package on npm, a package pulled millions of times a month. OpenAI has already fixed the core bug, so there is nothing to patch on your side; Depi’s advice, in its November 11 writeup, is a short cooldown before you let auto-updating tooling pull a release the day it drops.

The behavior change is the whole point. If you run Codex CLI with automatic updates enabled, you are in scope: no version pin to review, no pull request to approve, no window in which a human reads the diff before the new build lands. A short cooldown lets someone else be the guinea pig, and buys maintainers and the security community time to spot a poisoned release before it reaches your machine.

From a GitHub issue to npm

The chain started in a GitHub Actions workflow, issue-labeler.yml, that uses Codex to suggest labels for new issues. It fed the issue title and body straight into the agent’s prompt, and the action ran with allow-users: "*", so anyone who could open an issue could reach it. Depi found a phrasing that made Codex read the issue body as instructions rather than data, then compressed and encoded its script so the agent’s guardrails did not recognize it as malicious, and got shell commands running inside the Codex sandbox.

That sandbox only allowed writes to the working directory and /tmp, and blocked network calls. Depi escaped through the .NET debug pipes that GitHub’s runner leaves in /tmp: on Linux those are ordinary files the sandbox let it open, and the CoreCLR debugger behind them served unauthenticated requests to read the runner’s own memory. From that memory it lifted the runner’s GITHUB_TOKEN and ACTIONS_RUNTIME_TOKEN. Those tokens let it poison the Actions build cache, pivot into a more privileged workflow, rust-ci.yml, that carries write access, and plant a backdoor that opened a path to publishing a malicious release under OpenAI’s own npm identity. The Bugcrowd disclosure clocks @openai/codex at roughly 10 million downloads a week, spiking to 200 million.

Depi reported the chain through Bugcrowd with a full proof of concept, and OpenAI deployed a fix right away. The initial bounty was just $1,000, against a policy that lists up to $100,000 for critical findings; the report is still under further review.

Running is the feature

What is worth sitting with is where this began: not a memory-corruption flaw someone fuzzed for months, but a string of text in a workflow that trusted it. That matters more for Codex than for some library buried in a lockfile, because Codex is an agent. It runs on developer machines, with developer credentials, inside repositories that matter, and it is built to execute code. A malicious build, as Depi puts it, “doesn’t need to find a way to run. Running is the feature.”