OpenAI recently patched a Codex CLI vulnerability that can be exploited in attacks aimed at software developers, Check Point revealed on Monday.
Codex CLI is an open source coding agent that developers can run locally from their terminal. The AI agent can read, change, and run code on the machine, enabling users to improve documentation, write unit tests, generate architecture diagrams, propose PRs, and look for vulnerabilities using natural language commands.
Check Point researchers discovered that the tool automatically loaded and executed commands defined within local project configurations. The commands in these configuration files are implicitly trusted, and they are executed without first obtaining the user’s approval.
An attacker who can commit or merge specially crafted configuration files into the targeted developer’s repository can plant files that trigger the execution of malicious commands.
[ Read: OpenAI User Data Exposed in Mixpanel Hack ]
“An initially innocuous config can be swapped for a malicious one post-approval or post-merge, creating a stealthy, reproducible supply-chain backdoor that triggers on normal developer workflows,” Check Point warned.
The security firm’s researchers showed how an attacker could exploit the Codex CLI vulnerability to deploy a reverse shell for persistent remote access, silently execute arbitrary commands, exfiltrate credentials and other secrets, escalate privileges, and move laterally.
An attacker could also leverage the flaw to mount supply chain attacks.
“Compromised templates, starter repos, or popular open-source projects can weaponize many downstream consumers with a single commit,” Check Point explained. “If CI, automation, or build agents run codex on checked-out code, the compromise can move from workstations into build artifacts and downstream deployments.”
The vulnerability, tracked as CVE-2025-61260, was reported to OpenAI in August, and a patch was made available less than two weeks later with the release of Codex CLI 0.23.0.
Related: Microsoft Highlights Security Risks Introduced by New Agentic AI Feature
Related: WormGPT 4 and KawaiiGPT: New Dark LLMs Boost Cybercrime Automation
