A carefully crafted branch name can steal your GitHub authentication token

Security researchers have discovered a command injection vulnerability in OpenAI’s Codex cloud environment that allowed attackers to steal GitHub authentication tokens using nothing more than a carefully crafted branch name.

Research from BeyondTrust Phantom Labs found the vulnerability stems from improper input sanitization in how Codex processed GitHub branch names during task execution.

By injecting arbitrary commands through the branch name parameter, an attacker could execute malicious payloads inside the agent’s container and retrieve sensitive authentication tokens that grant access to connected GitHub repositories.

Article continues below

A vulnerability in plain sight

What makes this attack ...