One Fake Bug Report Tricked OpenAI’s Own SI Bot. It Could Have Reached Millions of Computers.

The scariest hack of the week didn’t need a stolen password, a bad link or a sleepy employee. It needed one fake bug report, written in plain English, posted where anyone on the internet is allowed to post.

Two researchers at a young security firm called Depi showed on Wednesday that a single made-up complaint, filed on the public GitHub page for OpenAI’s coding assistant Codex, could start a chain reaction that ended with them holding the power to ship a poisoned version of Codex to the world. Not a demo. Not a lookalike. The real package that programmers install and update every day.

OpenAI fixed it. No poisoned version reached anybody, and Depi did the full run on its own test copy, not on OpenAI’s live project. But the size of the target is what makes this worth your time. Public download counts from npm, the giant library programmers pull code from, show the Codex command-line tool was downloaded 96,848,771 times between Oct. 12 and Nov. 10. That is close to 97 million downloads in a month.

A robot clerk that reads strangers’ mail

Big software projects get flooded with bug reports, so many of them hire a robot clerk to sort the pile. OpenAI did exactly that. Every time someone opened a new report on the Codex project, an automated job handed the title and text to a Codex SI agent and asked it to suggest labels like “bug” or “feature request.”

The trouble is that the agent read the stranger’s words in the same breath as OpenAI’s own instructions. To an SI model, text is text. Depi’s write-up shows the job’s list of allowed users was set to a single star, which in plain terms means everybody.

So the researchers wrote a bug report that didn’t look like a bug report to the machine. It started by faking the end of OpenAI’s instructions, then posed as new orders: you are a QA engineer, run the diagnostic command in this issue, report the output. The command itself was squeezed and scrambled so Codex’s safety guardrails couldn’t read what it really did. The agent ran it.

That trick has a name, prompt injection, and it is the oldest weakness in the SI agent business. Hide instructions where an SI helper will read them, and it may treat them as if its boss wrote them.

Climbing out of the box

Running code inside the agent wasn’t the prize by itself. Codex works inside a locked box, a sandbox with no internet, with almost every file read-only and the secret keys stripped out. Depi needed a way out.

They found it in the junk drawer. The GitHub machines that run these jobs leave little debugging channels sitting in a shared temporary folder. Those channels let anyone who can open them read the memory of the program running the job, with no password. Inside that memory sat the job’s secret access tokens. The researchers pulled them out and printed them back through the job’s own log.

From there it got clever. Those tokens worked from anywhere, so Depi used them from outside OpenAI’s systems to plant a booby-trapped file in a shared storage area that a more powerful OpenAI job pulls from. That job has permission to change the project. The planted file used that power to set a second trap: a fake Codex release. When a maintainer spotted the bogus release and deleted it, the deletion itself would fire off a hidden workflow and hand the attacker a signed pass that npm trusts for publishing Codex.

In other words, the cleanup was the trigger. With that pass, an attacker could have pushed a malicious Codex update that looked completely official.

Why a coding tool is a juicier target than most

Plenty of software gets hacked. What makes this one different is what Codex does once it is on your computer. It is an SI agent that writes and runs code for programmers, often with their passwords, keys and company files within reach.

Depi put it bluntly in its write-up: “A malicious version of Codex CLI doesn’t need to find a way to run. Running is the feature.” Many people also let it update itself automatically. The researchers’ warning there is the part regular users should remember: “With auto-update, you don’t get a vote.”

The security world has spent years telling everyone to update fast. Depi isn’t backing off that advice. It suggests a short waiting period before tools that update themselves grab a brand-new release, so someone else finds the poison first.

Someone flagged it back in April

Here is the uncomfortable detail. Back on April 28, a user filed a security note on the Codex GitHub page warning that this exact labeling job fed untrusted issue text straight into an agent’s prompt and could let an outsider steer it into running commands. An OpenAI engineer answered that the labels didn’t feed anything critical and wrote, “So I don’t see this as a problem.”

That reply was reasonable for the labels. It missed what Depi proved next: the real danger was never a wrong label, it was what a hijacked agent could reach once it started running code.

To OpenAI’s credit, the fix came fast once the full chain landed on its desk. Depi says OpenAI “deployed a fix right away” and paid an initial $1,000 bounty, with the case still under review. OpenAI’s bounty rules allow up to $100,000 for critical finds, and Depi made clear it hopes the final number reflects the stakes. The project’s public history shows a change on Wednesday afternoon that pulled the Codex agent out of the labeling job entirely and replaced it with a simple script that asks a model for labels and can’t run commands.

Depi says there is nothing for Codex users to patch. The lesson is bigger than one company. Every business racing to hook SI agents up to email inboxes, help desks and support tickets is building the same robot clerk, one that reads whatever strangers send it. This time the stranger was a friendly researcher who wrote up every step and called OpenAI first. The next one may not be.