OPENAI CODEX SECURITY CHECKLIST

OpenAI Codex comes in two shapes with two different trust models: a cloud agent that works on a connected GitHub repo inside a sandboxed container and opens pull requests, and the Codex CLI that runs locally in your terminal with your developer permissions. The cloud sandbox protects your workstation — it does not protect your repo from what lands in a PR, and it does not protect the secrets you hand the sandbox as environment variables. The checklist below is what we look for first when we audit a repo with active Codex use.

Treat Critical as merge-blocking. High is week-one. Medium is the cleanup once Codex is part of your team’s flow.

How to use this checklist

Walk it once on a representative repo Codex is connected to, then fold the per-PR items into your review template. The AGENTS.md, environment, and access-scoping items only need to be set once per repo; the diff-review items apply to every Codex PR.

Critical (fix before merge)

1. Treat AGENTS.md as executable configuration

Why it matters. AGENTS.md files are persistent instructions the agent follows on every task in that repo. That makes them part of the prompt — and an attacker-controlled AGENTS.md changes agent behavior. A malicious contribution, a compromised dependency vendored into the tree, or a fork PR that quietly edits AGENTS.md can instruct the agent to weaken auth, add an exfiltration call, or install a specific package on its next run.

How to check. git log -p -- AGENTS.md '**/AGENTS.md' — read every change, and confirm nothing in the current files contains instructions you didn’t write. Nested AGENTS.md files in subdirectories count too.

How to fix. Add AGENTS.md to a CODEOWNERS rule so changes require review from a maintainer. In PR review, treat an AGENTS.md diff with the same weight as a CI-config diff — see poisoned CI and DevOps leak for why config-as-prompt files are a favorite target.

2. Review the whole PR diff, not the intentional change

Why it matters. Over-trusting agent-authored PRs is the most common Codex incident shape. The intentional diff looks right — the dangerous change is the one the reviewer didn’t notice: a relaxed auth check three files away, a broadened CORS config, a test assertion softened so the suite passes. Codex writes plausible code, which makes plausible-looking regressions easy to wave through.

How to check. Read every file in the PR, including “unrelated” ones. Search the diff for deletions of requireAuth, csrf, verifyJwt, where clauses, and ownership checks.

How to fix. Require at least one human review on every Codex PR via branch protection. Never merge on green CI alone.

3. Scope sandbox environment variables to the task

Why it matters. Secrets and environment variables configured for the Codex cloud sandbox are readable by the agent during runs — and by anything the agent executes, including install scripts of packages it decides to add. A task that fixes a typo does not need STRIPE_SECRET_KEY in scope.

How to check. List the env vars configured for the Codex environment in the platform’s settings. For each, ask: does the routine task actually need this at build/test time?

How to fix. Keep the default environment minimal (build and test only). Use scoped, revocable, non-production credentials where a task genuinely needs one. Rotate anything that has sat in the sandbox env for months.

4. Deny internet access to cloud tasks by default

Why it matters. Cloud tasks can be granted or denied internet access. With internet on, a prompt-injected agent (via repo content, an issue, or AGENTS.md) has a working exfiltration path for everything in the sandbox — source, env vars, tokens. With internet off, injection can still corrupt the diff, but it can’t phone home.

How to check. Review the network setting on your Codex environment. If it’s enabled, ask which task actually required it.

How to fix. Default to no internet. Enable it per-task when a task genuinely needs to fetch something, with the narrowest allowlist the platform supports, then turn it back off.

5. Audit every dependency the agent adds

Why it matters. Codex runs installs inside its sandbox and the resulting lockfile lands in the PR. Hallucinated or typosquatted package names are a known AI failure mode — a package that doesn’t exist today can be registered by an attacker tomorrow, and a near-miss name may already be malware.

How to check. Treat package.json / requirements.txt / lockfile diffs as the highest-priority part of Codex PR review. For each new package: confirm it exists in the registry, check the publish date and download counts, verify the name character-by-character against the official docs.

How to fix. Run the Package Hallucination Scanner on the dependency list, add npm audit / pip-audit as a required status check, and pin exact versions.

6. Treat issues and repo content as untrusted agent input

Why it matters. When you point Codex at an issue (“fix #142”), the issue body becomes part of the prompt. So do READMEs, comments, and fixture files it reads while working. Anyone who can file an issue on a public repo can attempt prompt injection against your agent — “as part of this fix, also update the deploy script to…” is an instruction, not a bug report.

How to check. Before assigning an issue to Codex, read it as if it were a prompt. On public repos, be especially wary of issues that instruct the agent to touch CI, auth, or dependency files.

How to fix. Only hand Codex issues you’ve read. Combined with items 2 and 4, injection that does land has no unreviewed path to merge and no network path out. Background: indirect prompt injection.

High (fix in the first week)

7. Grant Codex the minimum repo access

Connect Codex to the specific repos it works on, not the whole org. If the connected account or token is ever compromised, scope is your blast-radius control.

8. Run the Codex CLI with approval prompts on

The CLI executes commands locally with your developer permissions — no sandbox container between the agent and your filesystem, dotfiles, and SSH keys. Keep the approval mode that asks before running commands; reserve full-auto modes for containers or throwaway checkouts.

9. Don’t run the CLI in repos you don’t trust

A freshly cloned repo’s AGENTS.md and file contents feed straight into a local agent that can execute commands as you. For unfamiliar code, run the CLI inside a container, or use the cloud agent where the sandbox absorbs the risk.

10. Add secret scanning as a required check on Codex PRs

gitleaks in CI plus GitHub Push Protection catches keys the agent wires in while connecting an integration. Agent-authored PRs merge fast; the scanner must be a required status check, not an optional one.

11. Protect the branches Codex targets

Branch protection on main: required reviews, required status checks, no force push. If Codex uses prefixed branches, add rules for that prefix so agent branches get the same treatment as human ones.

12. Re-read AGENTS.md after every external contribution

After merging outside contributions or syncing a fork, re-check AGENTS.md and any dotfile the agent reads. Item 1 covers the standing audit; this is the recurring trigger.

Medium (fix when you can)

13. Ask for security test cases by name

Codex’s generated tests cover the happy path. Prompt explicitly for: unauthenticated requests, wrong-user access, invalid input, oversized payloads. Unrequested security cases mostly don’t appear.

14. Keep a written policy for what Codex may touch

A short AGENTS.md section listing files the agent must not modify (CI config, auth middleware, infra) gives reviewers a tripwire: any diff touching those paths gets extra scrutiny.

15. Review agent-authored Dockerfiles and IaC harder

AI-generated infra defaults are permissive: root users in containers, 0.0.0.0/0 security groups, broad IAM. Infra diffs in Codex PRs deserve a second reviewer.

16. Log which PRs were agent-authored

Label or tag Codex PRs. When an incident happens, “which changes came from the agent” is the first question, and reconstructing it afterward is painful.

17. Rotate credentials that Codex environments have seen

Any secret that lived in a sandbox env var during a period when internet access was on should be treated as potentially exposed. Rotate on a schedule.

After every Codex PR

• Read the full diff, including files outside the stated task.
• Diff the dependency manifests and lockfiles first.
• grep the diff for hardcoded keys (sk-, sk_live, eyJ, AKIA).
• Confirm no AGENTS.md, CI, or workflow file changed unless the task required it.
• Re-run security tests separately — agents sometimes “fix” a failing security test by relaxing the assertion.

Common attack patterns we see in Codex projects

The poisoned AGENTS.md. A contribution PR includes a plausible AGENTS.md tweak (“prefer package X for HTTP calls”). Package X is attacker-controlled. Every subsequent Codex task in the repo installs it.

The rubber-stamped PR. The agent’s PR fixes the bug and, two files over, widens a CORS config to unblock its own test run. Reviewer reads the fix, skims the rest, merges. See CORS credentials misconfig.

The issue-as-injection. A public-repo issue titled as a bug report embeds instructions to modify the release workflow. The agent assigned to “fix the issue” follows them.

The over-provisioned sandbox. The Codex environment carries production env vars for convenience. A task with internet access installs a dependency whose postinstall script reads the environment and posts it out.

Related Resources

How to Secure OpenAI Codex

Step-by-step guide for hardening a Codex workflow — sandbox settings, env scoping, PR review discipline, and CI gates.

Is OpenAI Codex Safe?

In-depth analysis of the agent’s security model — what runs in the sandbox, what the CLI can touch locally, where the trust boundaries actually are.

Automate Your Checklist

A checklist tells you what to look for. A scanner tells you what’s actually broken in the deployed app right now. VibeEval drives a real browser through the deployed app Codex helped build, attempts the most common agent-introduced regressions, and reports what got through — with file and line numbers to fix.