Severity
Exposure
Date of incident
Codex Token Injection
reported
Tier -
A
Codex passed branch name to shell unsanitized — GitHub OAuth token exited agent container.
What Happened
Attacker with repo write access set malicious branch name with shell metacharacters; Codex container evaluated branch during clone and exfiltrated GitHub user access token to attacker — scalable across repo collaborators.
Sumarry
BeyondTrust disclosed critical Codex command injection: unsanitized GitHub branch names in agent container setup enabled OAuth token theft across web, CLI, SDK, and IDE surfaces.
Detect
Sanitize all agent-controlled shell args; secret scan on agent logs
What Happened
Trust Vault for OAuth; no raw tokens in agent containers
Blekline //
Mask OAuth at agent ingress; block exfil tools post-contamination
Without agent boundary //
Rotate GitHub token after vendor patch — no prevent at shell boundary
