OpenAI Codex Vulnerability Allows Remote Code Execution via Malicious Folders

A critical remote code execution (RCE) vulnerability has been identified in OpenAI Codex, a powerful AI model used for code generation and understanding. The vulnerability, assigned the identifier CVE-2026-19591 by the Zero Day Initiative (ZDI), carries a CVSS score of 7.8, indicating a high level of severity.

Exploitation of this flaw requires user interaction, specifically tricking a user into opening a malicious folder. This vector suggests that social engineering or the distribution of compromised files could be primary methods for attackers to initiate an attack. Once a user opens the crafted folder, the vulnerability can be triggered.

The root cause of the vulnerability lies in the way OpenAI Codex handles arguments passed to git commands. The system fails to properly neutralize control sequences within these arguments. This oversight allows an attacker to inject malicious commands that are then executed with the privileges of the current user, potentially leading to full system compromise.

OpenAI has acknowledged the vulnerability and has released an update to address the issue. The prompt disclosure timeline indicates that the vulnerability was reported to the vendor on June 2, 2026, and a coordinated public release of the advisory occurred on September 10, 2026, with an update to the advisory on the same day.

The discovery and reporting of this vulnerability are credited to Cyrill Bannwart, Emanuele Barbeno, Yves Bieri, Lukasz D., and Urs Mueller from Compass Security. Their work highlights the ongoing need for rigorous security testing of AI development tools and platforms.

While the specific impact and scale of exploitation in the wild are not yet detailed, the high CVSS score and the nature of RCE vulnerabilities mean that affected installations are at significant risk. Organizations utilizing OpenAI Codex should prioritize applying the available update to mitigate this threat.

This vulnerability underscores the growing security concerns surrounding AI development tools. As these platforms become more integrated into software development workflows, their security posture becomes increasingly critical. A compromise in such a tool could have far-reaching consequences, potentially impacting the security of numerous downstream projects and applications.

Users and administrators of OpenAI Codex are strongly advised to consult OpenAI's official security advisories and apply any available patches or updates immediately. Further details on the vulnerability can be found via the CVE record at https://www.cve.org/CVERecord?id=CVE-2026-19591.

The Zero Day Initiative advisory ZDI-26-651 provides further technical details on the OpenAI Codex vulnerability, assigning it the CVE identifier CVE-2026-19593 and a CVSS score of 7.8. The vulnerability, discovered by Ikotas Labs, stems from improper sanitization of configuration settings within the handling of configuration files, requiring user interaction via opening a malicious folder for exploitation.