OpenAI Codex Flaw: When AI Coding Tools Steal Your GitHub Tokens

What Happened with OpenAI Codex?

Security researchers identified a critical vulnerability in OpenAI Codex, the AI-powered coding assistant that underpins tools like GitHub Copilot and the Codex API. The flaw, if exploited, would have allowed an attacker to extract GitHub personal access tokens (PATs) from within the Codex environment. Those tokens are the keys to your code repositories — and by extension, your entire software supply chain. The OpenAI Codex vulnerability was reported responsibly to OpenAI before public disclosure, and a fix was applied. But the mechanism behind the flaw is exactly the kind of thing that should make any security-conscious development team stop and reassess how much trust they are placing in AI coding tools. OpenAI has not published a full technical breakdown at time of writing, but the research aligns with a known class of attacks against large language model (LLM) environments: indirect prompt injection and insecure credential handling in sandboxed execution contexts. Put simply, AI tools that operate alongside your code can sometimes be manipulated into leaking what they should not be touching.

Why GitHub Tokens Are Such High-Value Targets

A GitHub personal access token is not just a login credential. Depending on the permissions granted, a compromised PAT can give an attacker read and write access to private repositories, the ability to push malicious code into production pipelines, access to secrets and environment variables stored in GitHub Actions, and visibility into issue trackers, pull requests, and internal project documentation. This is the digital equivalent of handing someone your office keycard, the combination to the safe, and a map of the building. For organisations running continuous integration and continuous deployment (CI/CD) pipelines, a stolen token can cascade into a full software supply chain compromise. An attacker with write access to a repository can inject backdoors into code that gets shipped to thousands of downstream users — the SolarWinds and XZ Utils incidents demonstrated exactly how damaging this attack path can be. According to the 2024 Verizon Data Breach Investigations Report, 15% of breaches involved a third party or supplier component. When your AI coding assistant becomes a vector for credential theft, that statistic becomes very relevant.

How This Class of Vulnerability Works in AI Coding Tools

AI coding assistants like Codex operate by processing context — your code, your comments, your repository structure — and generating responses based on that input. The security problem arises when that context includes sensitive material, such as API keys, tokens, or credentials that developers have (often accidentally) left inline in their codebase. In a well-designed environment, the AI processes that context but does not transmit it externally. The vulnerability in Codex appears to have broken that boundary — creating a path through which credentials present in the working context could be exfiltrated. This is structurally similar to prompt injection attacks, where malicious instructions embedded in data inputs manipulate an AI model into taking unintended actions. In this case, the 'unintended action' is handing over your GitHub token. The broader implication is that any AI tool with access to your codebase has, by definition, access to whatever secrets your codebase contains. If that tool has a vulnerability — or if it is compromised at the infrastructure level — those secrets are exposed. Developers who treat AI assistants as a 'clean room' environment are taking a risk they may not have fully considered.

What This Means for UK and ANZ Development Teams

Adoption of AI coding tools has accelerated sharply across UK and Australasian markets. A 2024 Stack Overflow Developer Survey found that 76% of developers are now using or plan to use AI coding tools in their workflows. Many of those tools — Copilot, Cursor, Tabnine, and others — are built on or similar to the Codex model architecture. For UK businesses operating under GDPR and the UK Data Protection Act 2018, the exposure of credentials that grant access to source code repositories carrying personal data or proprietary systems is a notifiable incident risk. For New Zealand and Australian organisations, the Privacy Act obligations are similarly clear. Beyond compliance, there is a practical risk to managed service providers, software vendors, and any organisation that ships code to clients. If an AI tool running in your development environment can be used to harvest tokens, then the integrity of everything that code touches is in question. This is precisely the kind of third-party risk that Panorays, our supply chain risk management platform, is built to surface. When your developers are using third-party AI tooling with access to production credentials, that tooling belongs in your third-party risk register — assessed, monitored, and scoped appropriately.

How Attackers Could Have Exploited This Flaw in Practice

Here is a realistic attack chain built on this vulnerability: First, a developer opens a repository in an environment where Codex has been integrated — common in VSCode extensions or web-based coding platforms. The repository contains a GitHub token, either hardcoded (poor practice but widespread) or present in a configuration file loaded into context. The attacker has either found a way to trigger the vulnerability remotely through crafted repository content, or they have delivered a malicious prompt injection through a dependency, a README file, or even an issue comment that the developer opens in the same session. Codex processes the context, and through the vulnerability, the token is transmitted to an attacker-controlled endpoint. The attacker now holds valid credentials with whatever scope that token carries. From here, the attack can go in several directions: lateral movement into connected systems, code tampering, or simple exfiltration of intellectual property. If the compromised repository feeds into a production CI/CD pipeline, the attacker has a staging post inside the software supply chain. BlackFog's anti-data exfiltration (ADX) technology is specifically designed to intercept this final stage — the unauthorised outbound transmission of data. Even if a token is captured from memory or context, ADX can block the exfiltration attempt before it reaches an external server. You can read more about how BlackFog works on our products page.

• Hardcoded credentials in developer repositories remain a persistent problem — a 2023 GitGuardian report found over 10 million secrets exposed in public GitHub commits in a single year
• AI coding tools expand the attack surface by adding another layer of context processing between the developer and the codebase
• Prompt injection via repository content is an emerging and largely undefended vector
• Token compromise can enable silent code tampering with no immediate forensic trace

What a Stronger Security Posture Looks Like Here

No single control eliminates this risk, but several layers together make exploitation significantly harder and exfiltration detectable. Start with credential hygiene. Developers should never store tokens, API keys, or secrets in code — full stop. Use a secrets manager, enforce pre-commit hooks that scan for credentials, and rotate tokens regularly. GitHub itself offers secret scanning alerts for public and private repositories. Next, apply the principle of least privilege to AI tooling. If your Codex or Copilot integration does not need access to your production repository, do not grant it. Scope tokens used in AI environments to the minimum permissions required. For organisations with continuous attack surface exposure, Hadrian's AI-driven attack surface management continuously maps external-facing assets and identifies credential exposure pathways before attackers do. That kind of proactive visibility matters when new tooling is being introduced into development workflows at pace. From an endpoint and email security perspective, Coro's unified platform can enforce policies around what AI tools are permitted on managed devices, flagging or blocking unsanctioned integrations that could introduce credential-theft vectors. For ANZ organisations running ESET across their enterprise estate, endpoint behaviour monitoring can detect anomalous outbound traffic patterns consistent with credential exfiltration. Finally, treat AI coding tools as third-party vendors — because that is exactly what they are. They process your data, they run on external infrastructure, and they carry their own vulnerability surface. Panorays can bring structured risk assessment to these vendor relationships, ensuring that your AI tooling is evaluated with the same rigour you apply to any other supplier with access to sensitive systems.

The Bigger Pattern This Incident Reveals

This vulnerability is not an isolated incident. It is part of a pattern. As AI tools embed themselves deeper into development workflows, they become high-value targets precisely because they sit at the intersection of credentials, code, and cloud infrastructure. A compromised AI coding assistant is not just a privacy problem — it is a software supply chain problem. The security industry spent years building controls around what developers deploy. Now attackers are targeting what developers build with. That shift demands a different kind of vigilance. Sophos MDR (Managed Detection and Response) provides 24/7 threat monitoring that can detect the behavioural indicators of a supply chain compromise in progress — unusual repository access patterns, anomalous API calls, lateral movement following a credential theft event. When an incident like this occurs, response speed is the variable that determines whether a token theft becomes a full supply chain breach or a contained incident. OpenAI patched this vulnerability before it was publicly exploited — that is the best-case outcome. But the next flaw in the next AI tool may not surface through responsible disclosure. Organisations that assume their development tooling is clean because it comes from a reputable vendor are betting their supply chain integrity on a single point of trust. That is not a security posture. It is a hope.

Frequently Asked Questions