Cases › security breach › LR-2026-0541

OpenAI Codex authentication tokens stolen via malicious npm package codexui-android

Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report

Status: fix reported

Severity moderate

Reported 1 Jun 2026

Developer and model OpenAI

No source states: loss or records, agent tool, could do, deployer, industry.

Severity moderate: test: data of others touched with a bounded scope stated; the source states over 29,000 weekly downloads of the affected package and no unbounded scope.

A malicious npm package named codexui-android, advertised as a remote web UI for OpenAI Codex and attracting over 29,000 weekly downloads, was used to collect Codex authentication tokens. The associated GitHub repository remained clean, and the malicious code was reportedly introduced into the published npm package about a month after it was first published. When a developer ran the tool, it looked for Codex authentication tokens and sent them to an attacker-controlled server. The stolen tokens included a refresh token that does not expire. Aikido Security researchers found and disclosed the activity, and two related Android apps were also linked to the same exfiltration chain. The package author said the affected functionality and related data were being removed.

What happened

1 · What it was doingThe system was OpenAI Codex, a coding assistant and software engineering agent, and the malicious package was offered as a remote web UI for it.

2 · What went wrongAbout a month after release, an npm update added information-stealing code to the tool.

3 · What it reached or didThe code read the Codex auth file and sent its contents to a remote server disguised as a legitimate monitoring service.

4 · How it was caughtAikido Security researchers found and disclosed the attack.

What was done

The package author said the affected functionality and related data were being removed.

Fix reported

“Author stated the affected functionality and related data were being removed.”

No later incident for OpenAI under this risk on record.

Risks

Supply-chain compromise
Primary24 incidents
Rising: 4 vs 0.2 a week

Credential and privilege abuse
Also37 incidents

Data leaked or sent out
Also32 incidents

Read from the sources; not yet reviewed by a person.

Controls

Application

Did not exist Encryption of stored data

Control failure chain

L1 · Model Not stated in sourcesOpenAI

L2 · Harness Not stated in sourcesHarness not named

L3 · Application Did not existDeployer not named

L4 · Infrastructure / target Not stated in sourcesOrganisation hit

L1 · ModelOpenAIModel provider

No source mentions a control at this layer.

Model version not linked to a model card.

L2 · HarnessHarness not namedAgent framework vendor

No source mentions a control at this layer.

Other controls for this risk at this layer, not mentioned in the sources: Sandboxed code execution.

L3 · ApplicationDeployer not namedDeployer

Did not existEncryption of stored data“It's worth mentioning here that every time a user logs in to the Codex app, CLI, or IDE Extension using either ChatGPT or an API key, the login details are cached locally in a plaintext file at ~/.codex/auth.json or in the operating system-specific credential store.”The Hacker News

Other controls for this risk at this layer, not mentioned in the sources: Signed and verified components, Vetting of plug-ins, skills and dependencies, AI bill of materials, Vulnerability scanning of AI components, Model provenance checks, Least-privilege access for the agent.

L4 · Infrastructure / targetOrganisation hit

No source mentions a control at this layer.

Other controls for this risk at this layer, not mentioned in the sources: Secrets scanning.

EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target

Controls for this risk: result in this incident

Control	Part of the system	Result
Sandboxed code execution	L2 Harness	Not stated in sources
Encryption of stored data	L3 Application	Did not exist
Least-privilege access for the agent	L3 Application	Not stated in sources
Signed and verified components	L3 Application	Not stated in sources
AI bill of materials	L3 Application	Not stated in sources
Vetting of plug-ins, skills and dependencies	L3 Application	Not stated in sources
Vulnerability scanning of AI components	L3 Application	Not stated in sources
Model provenance checks	L3 Application	Not stated in sources
Secrets scanning	L4 Infrastructure / target	Not stated in sources

Similar incidents

EMBRACE: Codex embedded browser reads files outside the project via malicious HTML2026-10-30

Malicious AGENTS.md in Downloads folder hijacks Codex and Claude Code agents2026-10-26

Researchers break out of OpenAI Codex sandbox twice2026-09-21

Unauthorized relay service reconfigures genuine Codex and Claude Code CLIs, disabling sandboxes and replacing credentials2026-10-29

All cases of this kind ›

Evidence

No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 3 items from the primary sources

What happened, in order

2026-04-12 Domain sentry.anyclaw[.]store registered; the first version (0.1.72) of the npm package had been uploaded two days earlier.

Not dated in the sources:

Malicious code introduced into the npm package about a month after it was first published.
Package author stated the affected functionality and related data were being removed.

Show every field, with its source and grade

The AI system

Developer

OpenAI

C one secondary source states it

What happened

Earliest source we hold

2026-06-01

D inferred by us from the described behaviour, reason shown

Who caught it

an outside party

C one secondary source states it

Cause in detail

Malicious code was present in the published npm package but not in the public GitHub source code.

C one secondary source states it

Who caused it

an outside attacker

C one secondary source states it

What was done

Author stated the affected functionality and related data were being removed.

C one secondary source states it

What went wrong

security breach

C one secondary source states it

primary risk

RK06

D inferred by us from the described behaviour, reason shown

secondary risks

RK03, RK04

D inferred by us from the described behaviour, reason shown

control chain

layer: L3; party: deployer; control id: H3; outcome: missing; quote: It's worth mentioning here that every time a user logs in to the Codex app, CLI, or IDE Extension using either ChatGPT or an API key, the login details are cached locally in a plaintext file at ~/.codex/auth.json or in the operating system-specific credential store.; source index: 0

C one secondary source states it

Impact

Severity

moderate

D inferred by us from the described behaviour, reason shown

Kinds of data exposed

authentication tokens, account ID

C one secondary source states it

Why this severity

test: data of others touched with a bounded scope stated; the source states over 29,000 weekly downloads of the affected package and no unbounded scope.

D inferred by us from the described behaviour, reason shown

Notes on gaps

Controls were limited to those the sources tie to this incident.

LR-2026-0541 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON