Critical Vulnerability in OpenAI Codex Allowed GitHub Token Compromise

OAuth tokens are frequently complicit in breaches involving AI. When researchers found an obfuscated token while examining the relationship between OpenAI Codex and GitHub, they took notice.

OpenAI Codex is an LLM designed to translate natural language prompt instructions into working source code. It is widely used by developers in their interaction with GitHub repositories for generating new code from ideas and performing pull requests.

OAuth tokens have a checkered relationship with AI. While necessary, they were the primary breach vector in the Salesloft incident during 2025 – leading to compromise in more than 700 organizations. And in March 2026, Grip Security published research into Shadow AI and OAuth tokens in SaaS apps, describing how one stolen token could cause cascading breaches across multiple companies that use the same SaaS app.

The weak link is not just the tokens, but tokens implemented with long term validity. BeyondTrust quickly discovered that the ...