OpenAI Codex ships real, working code through a cloud agent, a CLI, and an IDE extension - all built around sandbox modes and approval policies rather than a one-click hosted stack. That sandbox limits what Codex itself can do on your machine; it doesn't make the code it writes secure. We audit Codex-built apps for the access-control and secrets gaps that slip through, plus the AGENTS.md and approval-mode risks unique to how Codex reads and trusts a repo.
Run a free 30-second scan Book an auditOpenAI Codex (the 2025 relaunch, distinct from the deprecated 2021 code-davinci Codex model) is an agentic software-engineering system with three surfaces: a cloud agent that runs tasks in isolated OpenAI-managed containers (ChatGPT web, iOS, Slack/Linear, and a GitHub Action / code-review bot via @codex), an open-source Codex CLI that runs locally, and an IDE extension - all powered by the Codex-tuned GPT-5 family ("gpt-5-codex"). Security here comes from two levers instead of one hosted stack: a sandbox mode (read-only, workspace-write, or danger-full-access) and an approval policy (untrusted, on-request, or never). Like other professional coding tools, Codex doesn't provision a backend, database, or auth for you - you choose the stack, which means nothing gets checked for you by default either.
These are the specific, recurring patterns we see when we audit apps built with Codex - not generic AI-code warnings.
Codex's GPT-5 family is Veracode's best-in-class performer on its benchmark (around 70% pass rate), but that still leaves roughly three in ten tasks failing - and specific vulnerability classes stay weak across nearly every model tested, Codex included: cross-site scripting fails about 86% of the time and log injection about 88%.
We fix it by testing for the specific vulnerability classes benchmarks miss, not assuming a stronger model means secure output.
AI-assisted commits leak secrets at roughly twice the rate of human-only commits - GitGuardian measured Claude Code-assisted commits at 3.2% versus 1.5% for a human baseline - and that pattern generalizes across agentic coding tools, Codex included, whenever API keys or tokens end up pasted into prompts or generated into example code.
We fix it by moving every secret into environment variables or a secrets manager, then scanning history for anything already exposed.
Codex CLI loads a repo's AGENTS.md file as trusted, operator-level instructions before it processes the actual task or PR content - so a malicious dependency or pull request can plant instructions Codex follows as if you'd typed them yourself. NVIDIA's AI Red Team has documented this exact indirect-injection path; a follow-up academic study found the highest success rate was for data-exfiltration attempts.
We fix it by auditing AGENTS.md and repo content as untrusted input and locking down what the agent can act on unsupervised.
Codex's danger-full-access sandbox and "never" approval policy exist for good reasons in CI pipelines, but left on out of habit they mean insecure or injected commands run with nobody in the loop - the opposite of the read-only / on-request defaults that make Codex safe to point at real code.
We fix it by auditing which sandbox and approval mode your team is actually running, not just what's documented in the setup guide.
This is about the Codex product itself, not the code it writes for you. OpenAI's API Platform and its ChatGPT Enterprise, Edu, Team, and Business tiers hold SOC 2 Type 2, and OpenAI will sign a HIPAA BAA on the API case-by-case via a sales request - but consumer ChatGPT plans are not BAA-eligible. Business, Enterprise, Edu, and API traffic isn't used for training by default, and Codex for Enterprise adds zero-data-retention, encryption, and audit logging through a Compliance API. None of that is a flaw in your app - but it does define what's actually covered if regulated data passes through Codex.
| Item | Status |
|---|---|
| SOC 2 Type 2 | API Platform, ChatGPT Enterprise / Edu / Team / Business |
| HIPAA / BAA | Case-by-case on the API only; consumer ChatGPT not eligible |
| Training on your code | Off by default for Business / Enterprise / Edu / API; Enterprise adds zero-data-retention |
| Sandbox mechanism | macOS Seatbelt, Linux/WSL2 Bubblewrap; cloud tasks run in isolated OpenAI-managed containers |
| Cloud agent network | Offline by default after setup; web search uses a pre-indexed cache to reduce live-page injection risk |
| Audit logging | Compliance API / OpenTelemetry - Enterprise and Edu tiers only |
These affect the Codex tool, not necessarily your app - but if you're running an unpatched version, they're worth knowing about.
| CVE / Issue | Severity | What it means |
|---|---|---|
| GHSA-w5fx-fh39-j5rw | High | A path-configuration bug let Codex CLI treat a model-generated working directory as the sandbox root, allowing file writes and command execution outside the session folder. Affected 0.2.0–0.38.0. Fixed in 0.39.0. |
| CVE-2025-61260 | Effectively critical | A repo shipping a .env that redirected CODEX_HOME plus a malicious config.toml could run arbitrary commands on startup with no approval prompt - silent, repeatable RCE. Fixed in CLI 0.23.0. |
| Codex cloud GitHub-token injection (no public CVE) | Critical | Command injection via a Unicode-disguised GitHub branch name stole GitHub Installation Access tokens and ran bash inside the code-review container when @codex was invoked. Hotfixed within days; fully patched February 2026. |
| Codex CLI web.run / Windows binary hijack | Disputed, unresolved | Malicious indexed web content could instruct the model to write a node.bat file that Windows would run before the real Node binary. OpenAI closed the report as "Not Reproducible"; the researcher disputes that finding. |
Codex's GPT-5 family scores best-in-class on Veracode's benchmark (about 70% pass), but that still means roughly 30% of tasks introduce a vulnerability, and specific classes like cross-site scripting and log injection stay weak across almost every model tested. Treat Codex output like any AI-generated code: reviewed before it ships, not trusted by default.
It's a file Codex CLI reads as trusted, operator-level instructions before processing your actual task or PR - which means a malicious dependency or pull request can plant instructions Codex follows unquestioned. Academic testing found indirect prompt injection through repo content succeeds 41-84% of the time against agentic coding assistants, highest for data-exfiltration attempts.
"Never" runs every command without asking - no human checkpoint at all. "On-request" pauses before anything happens outside the sandbox, which is the safer default. We check which mode your team is actually running, since it's easy to leave a permissive setting on from testing or CI.
The initial scan is free and takes about 30 seconds. A full audit starts at and any fixes we recommend are quoted separately based on what we actually find in your app.
Free 30-second scan, then a clear list of what needs fixing before real users touch it.
Run a free 30-second scan