rules-openai-codex

Inline interpreter in Codex context. An arbitrary code execution CVE (disclosed Aug 2025, patched in Codex CLI v0.23.0) was exploited via one-liner interpreter calls. Inline code execution with -c/-e flags can run obfuscated payloads.

Outbound network request from Codex context. OpenAI warns that Codex internet access 'exposes environments to security risks' and defaults network access to off. Verify the destination is a trusted development resource.

GitHub Actions workflow modification. Compromised Codex sessions with stolen GitHub Installation Access Tokens can inject malicious CI/CD steps that access repository secrets, push to package registries, or exfiltrate data on every future commit.

Container configuration written in Codex context. Verify: no pulls from unverified image registries, no exposed ports to 0.0.0.0, no host network mode, and no privileged containers that could facilitate sandbox escape.

Raw socket tool detected. Netcat/socat/bash /dev/tcp establish reverse shells or exfiltrate data outside HTTP, bypassing web-layer safeguards. These tools have no legitimate use in a Codex coding context.

Sandbox enumeration command logged. Attackers probe sandbox details (OS, user, env vars, /proc) before crafting Codex exploits. Logging for anomaly detection — multiple rapid probes indicate reconnaissance.

Long base64-encoded string in URL. Codex data exfiltration encodes stolen secrets in base64 and embeds them in URL paths or parameters to bypass keyword-based security controls. URLs with base64 payloads (32+ chars) are blocked.

Branch command injection detected. Codex CVE (patched Feb 2026): injecting shell metacharacters into git branch names grants lateral movement and read/write access to the entire codebase. Git operations must use plain branch names without shell operators.

DNS-based data exfiltration attempt. Codex sandbox safeguards can be bypassed using DNS queries to encode stolen data in subdomain lookups — a 'covert transport mechanism' documented by security researchers and confirmed by OpenAI. DNS resolution tools are blocked in Codex contexts.

Writing Git config or hooks in Codex context is blocked. The Codex branch injection attack achieved lateral movement by modifying Git configuration. Git hooks enable persistent code execution on every commit, push, or checkout — a durable persistence mechanism.

GitHub Installation Access Token access. The Codex branch injection attack (reported Dec 2025, patched Feb 2026) could steal GitHub Installation Access Tokens and execute bash on the code review container. Token access via shell commands is blocked.

Outbound HTTP POST in Codex context. The Codex DNS-based exfiltration bypass used HTTP requests to encode stolen data (GitHub tokens, environment secrets) and transmit them to attacker-controlled endpoints. Outbound data transfer via POST is blocked.