Critical Vulnerability in OpenAI Codex Allowed GitHub Token Compromise
OpenAI Codex vulnerability allowed extraction of GitHub OAuth tokens via branch name injection.
Researchers at BeyondTrust discovered a critical vulnerability in OpenAI Codex stemming from improper input sanitization in GitHub branch name processing. Attackers could inject arbitrary commands through branch names to execute malicious payloads, retrieve OAuth tokens, and potentially compromise multiple organizations sharing GitHub repositories. OpenAI patched the vulnerability in late December 2025 after responsible disclosure, but the research highlights expanding attack surfaces as AI agents gain access to sensitive credentials.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonA critical vulnerability in OpenAI Codex demonstrated how improper input sanitization in AI-powered development tools can lead to credential compromise. Attackers exploited inadequate validation of GitHub branch names to inject malicious commands that could steal OAuth tokens and access sensitive repositories. This incident highlights the expanding attack surface created when AI agents are granted access to authentication credentials and development environments. Organizations using AI-assisted coding tools must treat them as high-risk applications requiring strict input validation and credential management controls.
What helps against this
How we list vendors
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — OpenAI Codex command injection payload (obfuscated Unicode characters)