OpenAI Codex Had a Command Injection Bug That...

BeyondTrust's Phantom Labs just published a report on a command injection vulnerability in OpenAI's Codex. It's patched now, but the attack pattern matters because it's exactly the kind of thing vibe coders won't see coming. What Happened Codex runs tasks inside managed containers that clone your GitHub repo and authenticate using short-lived OAuth tokens. The vulnerability: branch names weren't sanitized before being passed to shell commands during environment setup. An attacker could craft a m