AI Risk Wire

Cases › security breach › LR-2026-0366

OpenAI Codex CLI command injection via project-local MCP configuration (CVE-2025-61260)

Confirmed Why: Check Point Research research · Check Point Research · 1 independent report

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: action reported, no fix

Severity major
Reported 1 Dec 2025
Agent tool OpenAI Codex CLI

No source states: loss or records, developer and model, could do, deployer, industry.

Severity major: Test: unbounded scope stated. The source says the flaw enables remote code execution in any environment where developers run codex against a repository. No exploitation in the wild is stated.

OpenAI's Codex CLI is a command-line tool that reads, edits and runs code from the terminal and supports MCP server integrations. Check Point Research found that the CLI automatically loaded and executed MCP server entries from a project-local configuration whenever codex was run inside that repository, with no interactive approval or re-check when values changed. Researchers demonstrated the path with a harmless file-creation payload and with reverse-shell payloads, both of which ran without user prompts. The researchers disclosed the issue to the OpenAI Codex CLI team on August 7, 2025. OpenAI issued a fix on August 20, 2025 in version 0.23.0, which stops .env files from redirecting CODEX_HOME into project directories.

What happened

1 · What it was doingCodex CLI reads, edits and runs code from the terminal for developers.
2 · What went wrongThe CLI loaded and ran MCP server commands from a project-local config without approval, validation or re-checks.
3 · What it reached or didAn attacker who could commit or merge the repository files could run commands on developers who cloned it and ran codex.
4 · How it was caughtCheck Point Research found the flaw in testing and disclosed it to OpenAI on August 7, 2025.

What was done

OpenAI fixed the flaw in Codex CLI 0.23.0 on August 20, 2025.

Risks

AI system attacked or breached
Primary23 incidents

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Vulnerability scanning of AI components · Adversarial testing before deployment · Short-lived, scoped credentials · Live behaviour monitoring · AI incident response plan · Segmentation of agent components · Encryption of stored data

Infrastructure / target

Known flaws patched · Intrusion and endpoint detection · Inventory of exposed services

Evidence

No source states: when it happened, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 2 items from the primary sources

What happened, in order

  1. 2025-08-07 Responsible disclosure of the issue to the OpenAI Codex CLI team.
  2. 2025-08-20 OpenAI issued a fix in Codex CLI version 0.23.0.
Show every field, with its source and grade

The AI system

Software around the model
OpenAI Codex CLI
C one secondary source states it
What it was for
Interact with projects from the terminal using natural language commands, automate tasks and streamline day-to-day development
C one secondary source states it

What happened

Earliest source we hold
2025-12-01
D inferred by us from the described behaviour, reason shown
What went wrong
security breach
C one secondary source states it

Impact

Severity
major
D inferred by us from the described behaviour, reason shown
Why this severity
Test: unbounded scope stated. The source says the flaw enables remote code execution in any environment where developers run codex against a repository. No exploitation in the wild is stated.
D inferred by us from the described behaviour, reason shown

Notes on gaps

The CVE identifier comes from the incident title and is not stated in the source body. Control mapping (B1, C3, C1, E3, J1) is my inference from the source's described gaps and fixes.

LR-2026-0366 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON