{"type":"post","id":"depi-security-chains-prompt-injection-in-openai-codex-8451f4","slug":"depi-security-chains-prompt-injection-in-openai-codex-8451f4","title":"Depi Security chains prompt injection in openai/codex issue labeler into a path to publish the @openai/codex npm package","description":"Depi Security says it chained prompt injection in OpenAI Codex’s GitHub issue-labeling workflow with a sandbox escape and runner-secret exposure, reaching a route toward publishing the official @openai/codex npm package.","retrieval_nugget":"Depi Security says it chained prompt injection in OpenAI Codex’s GitHub issue-labeling workflow with a sandbox escape and runner-secret exposure, reaching a route toward publishing the official @openai/codex npm package. The researchers say OpenAI fixed the core issue and no malicious release reached users. The case makes CI privilege separation an immediate design concern for teams using coding agents.","published_at":"2026-11-12","updated_at":"2026-11-12","record_date":"2026-11-12","date_kind":"published_at","topics":["github","codex","prompt-injection"],"entities":["Depi Security","OpenAI","Codex","openai/codex-action","GitHub Actions","@openai/codex","Bugcrowd"],"related_patterns":["agent-security-moves-to-runtime-boundaries"],"novelty_label":"new_fact","what_changed":"Depi reports exploiting a prompt-injection vulnerability in Codex’s GitHub Actions workflow to gain control of the publishing pipeline for OpenAI’s official npm package.","prior_refs":["https://newruntime.com/posts/check-point-research-haiou-jailbreak-bundle-for-openai-909895/"],"source_url":"https://depi.security/blog/20261111-backdooring-codex","source_urls":["https://depi.security/blog/20261111-backdooring-codex"],"schema_version":"newruntime-agent-readable-v0.2","stable_id":"post:depi-security-chains-prompt-injection-in-openai-codex-8451f4","status":"published","visuals":[],"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"routes":{"html":"https://newruntime.com/posts/depi-security-chains-prompt-injection-in-openai-codex-8451f4/","markdown":"https://newruntime.com/posts/depi-security-chains-prompt-injection-in-openai-codex-8451f4.md","json":"https://newruntime.com/posts/depi-security-chains-prompt-injection-in-openai-codex-8451f4.json"},"markdown_url":"https://newruntime.com/posts/depi-security-chains-prompt-injection-in-openai-codex-8451f4.md","next_reads":[{"type":"topic","path":"/topics/github/","url":"https://newruntime.com/topics/github/","title":"Github","reason":"Explore the github topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/github.md","json_url":"https://newruntime.com/topics/github.json"},{"type":"topic","path":"/topics/codex/","url":"https://newruntime.com/topics/codex/","title":"Codex","reason":"Explore the codex topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/codex.md","json_url":"https://newruntime.com/topics/codex.json"},{"type":"topic","path":"/topics/prompt-injection/","url":"https://newruntime.com/topics/prompt-injection/","title":"Prompt Injection","reason":"Explore the prompt-injection topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/prompt-injection.md","json_url":"https://newruntime.com/topics/prompt-injection.json"},{"type":"collection","path":"/posts/","url":"https://newruntime.com/posts/","title":"Field Notes","reason":"Open the latest editorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/posts.json"},{"type":"collection","path":"/sources/","url":"https://newruntime.com/sources/","title":"Sources","reason":"See the original sources this archive cites.","media_type":"text/html"}]}