---
title: A GitHub issue was enough: Depi chained a prompt injection in Codex's issue-labeling workflow into a path to publish the official @openai/codex npm package | ctxsec
url: https://ctxsec.com/items/depi-codex-issue-labeler-prompt-injection-sandbox-escape-cache-poisoning-npm-release-path
description: "Depi found that the openai/codex repo's issue-labeler GitHub Actions workflow fed untrusted issue titles and bodies straight into a Codex agent prompt, and anyone could trigger it by opening an issue. A crafted issue got command execution in the agent sandbox. Depi then escaped the workspace-write sandbox through .NET CLR debug pipes in /tmp to read the runner's memory and leak ACTIONS_RUNTIME_TOKEN and GITHUB_TOKEN, poisoned the Actions cache to reach the more privileged rust-ci workflow, and showed a route to the credentials used to publish @openai/codex. Depi reported it through Bugcrowd; OpenAI deployed a fix right away, and the current workflow runs Codex with a read-only sandbox."
status: "researcher disclosure (Depi blog and Bugcrowd disclosure, Nov 11, 2026); Depi says OpenAI fixed the core bug and no malicious release was published"
published: 2026-11-11
---

> Depi found that the openai/codex repo's issue-labeler GitHub Actions workflow fed untrusted issue titles and bodies straight into a Codex agent prompt, and anyone could trigger it by opening an issue. A crafted issue got command execution in the agent sandbox. Depi then escaped the workspace-write sandbox through .NET CLR debug pipes in /tmp to read the runner's memory and leak ACTIONS_RUNTIME_TOKEN and GITHUB_TOKEN, poisoned the Actions cache to reach the more privileged rust-ci workflow, and showed a route to the credentials used to publish @openai/codex. Depi reported it through Bugcrowd; OpenAI deployed a fix right away, and the current workflow runs Codex with a read-only sandbox.

[← Context & Harness Attacks](/context) · [markdown](/items/depi-codex-issue-labeler-prompt-injection-sandbox-escape-cache-poisoning-npm-release-path.md)

researcher disclosure (Depi blog and Bugcrowd disclosure, Nov 11, 2026); Depi says OpenAI fixed the core bug and no malicious release was published

2026-11-11 3:36 PM ET

### A GitHub issue was enough: Depi chained a prompt injection in Codex's issue-labeling workflow into a path to publish the official @openai/codex npm package

- **Pattern to look for in your own repos:** any workflow triggered by `issues`, `issue_comment` or `pull_request_target` that puts `${{ github.event.issue.body }}` (or titles, comments, PR text) into an AI agent's prompt while the job holds write tokens, secrets or cache access.
- **Fix:** give agent jobs read-only `permissions:` and a read-only sandbox, keep secrets and `id-token: write` out of jobs that read untrusted text, don't share Actions caches between untrusted and release workflows, and require a human step before publishing.
- **For Codex CLI users:** Depi says there is nothing to patch on your side; it suggests a short cooldown before auto-updating developer tools.
- Depi says OpenAI awarded an initial $1,000 bounty with the report still under review.

Sources: [Depi: Backdooring the next release of Codex through GitHub Action pipeline exploit chaining (Nov 11, 2026)](https://depi.security/blog/20261111-backdooring-codex/) · [Bugcrowd CrowdStream disclosure: Backdooring the next release of Codex](https://bugcrowd.com/disclosures/3c0e5972-74ad-46a3-ab56-169db3d4c66f/backdooring-the-next-release-of-codex-through-github-action-pipeline-exploit-chaining)