[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Context & Harness Attacks · markdown

researcher disclosure (Depi blog and Bugcrowd disclosure, Nov 11, 2026); Depi says OpenAI fixed the core bug and no malicious release was published

A GitHub issue was enough: Depi chained a prompt injection in Codex's issue-labeling workflow into a path to publish the official @openai/codex npm package

  • Pattern to look for in your own repos: any workflow triggered by issues, issue_comment or pull_request_target that puts ${{ github.event.issue.body }} (or titles, comments, PR text) into an AI agent's prompt while the job holds write tokens, secrets or cache access.
  • Fix: give agent jobs read-only permissions: and a read-only sandbox, keep secrets and id-token: write out of jobs that read untrusted text, don't share Actions caches between untrusted and release workflows, and require a human step before publishing.
  • For Codex CLI users: Depi says there is nothing to patch on your side; it suggests a short cooldown before auto-updating developer tools.
  • Depi says OpenAI awarded an initial $1,000 bounty with the report still under review.

Sources: Depi: Backdooring the next release of Codex through GitHub Action pipeline exploit chaining (Nov 11, 2026) · Bugcrowd CrowdStream disclosure: Backdooring the next release of Codex