Security & Sandboxing
Articles on sandbox policies, permission profiles, authentication, supply-chain security and hardening Codex.
368 articles
Adversarial Review: Why Structured Disagreement Beats Consensus in Your Codex CLI Code Review Pipeline
Adversarial Review: Why Structured Disagreement Beats Consensus in Your Codex CLI Code Review Pipeline
RADAR at Meta: What Risk-Calibrated Auto-Review Means for Your Codex CLI Guardian Pipeline
RADAR at Meta: What Risk-Calibrated Auto-Review Means for Your Codex CLI Guardian Pipeline
Backdoor Decontamination Dynamics: What 115 Experiments Reveal About Trusting Open-Weight Models in Your Codex CLI Pipeline
Backdoor Decontamination Dynamics: What 115 Experiments Reveal About Trusting Open-Weight Models in Your Codex CLI Pipeline
Trust but Verify: What 4,022 Agent-Generated Pull Requests Reveal About Security Debt — and How to Defend Your Codex CLI Pipeline
Trust but Verify: What 4,022 Agent-Generated Pull Requests Reveal About Security Debt — and How to Defend Your Codex CLI Pipeline
One Gate Is Not Enough: Why Composing Pre-Action Controls Matters for Your Codex CLI Hook Pipeline
One Gate Is Not Enough: Why Composing Pre-Action Controls Matters for Your Codex CLI Hook Pipeline
Egress Gates and the Prompt Data Boundary: How Hamza Closes the Gap Codex CLI's Built-In Redaction Cannot
Egress Gates and the Prompt Data Boundary: How Hamza Closes the Gap Codex CLI’s Built-In Redaction Cannot
Data as Code: How Codex CLI's Own Safety Instructions Became a Confused Deputy Attack on Windows
Data as Code: How Codex CLI’s Own Safety Instructions Became a Confused Deputy Attack on Windows
The Pre-Prompt Security Audit: A Practitioner's Playbook for Codex CLI Project Trust, MCP Poisoning, and Skill Supply-Chain Defence
The Pre-Prompt Security Audit: A Practitioner’s Playbook for Codex CLI Project Trust, MCP Poisoning, and Skill Supply-Chain Defence
Setup Complete, Now You Are Compromised: What Weaponised Setup Instructions Reveal About Codex CLI's Install Gap
Setup Complete, Now You Are Compromised: What Weaponised Setup Instructions Reveal About Codex CLI’s Install Gap
Actionable Hallucination Detection and the Latent Critic: What Real-Time Specification-Grounding Means for Your Codex CLI Hook and Guardian Strategy
Actionable Hallucination Detection and the Latent Critic: What Real-Time Specification-Grounding Means for Your Codex CLI Hook and Guardian Strategy
The Critic Engineering Playbook: Building Steering and Detection Layers for Codex CLI
The Critic Engineering Playbook: Building Steering and Detection Layers for Codex CLI
Steer, Don't Solve: What Small Critic Models Mean for Your Codex CLI Guardian and Hook Strategy
Steer, Don’t Solve: What Small Critic Models Mean for Your Codex CLI Guardian and Hook Strategy
Agent Safety as a Runtime Contract: What Preventive–Evidential Enforcement Means for Your Codex CLI Sandbox, Hook, and Guardian Strategy
Agent Safety as a Runtime Contract: What Preventive–Evidential Enforcement Means for Your Codex CLI Sandbox, Hook, and Guardian Strategy
Before the First Prompt: Pre-Prompt Code Execution Risks in Codex CLI and How to Defend Against Them
Before the First Prompt: Pre-Prompt Code Execution Risks in Codex CLI and How to Defend Against Them
DeltaBox and the Millisecond Checkpoint Problem: What Change-Based Sandbox State Management Means for Codex CLI's Exploration Budget
DeltaBox and the Millisecond Checkpoint Problem: What Change-Based Sandbox State Management Means for Codex CLI’s Exploration Budget
QuoteBench and the Command-Path Problem: Why Your Codex CLI Agent's Shell Commands Break Between Generation and Execution
QuoteBench and the Command-Path Problem: Why Your Codex CLI Agent’s Shell Commands Break Between Generation and Execution
Malicious Skill Files and the Agent Plugins Supply Chain: What 2,826 Adversarial Skills Reveal About Your Codex CLI Plugin Security Posture
Malicious Skill Files and the Agent Plugins Supply Chain: What 2,826 Adversarial Skills Reveal About Your Codex CLI Plugin Security Posture
APPA and the Taint Confinement Problem: Why Context Branching Beats Permanent Tainting — and What It Means for Codex CLI's Security Model
APPA and the Taint Confinement Problem: Why Context Branching Beats Permanent Tainting — and What It Means for Codex CLI’s Security Model
Vero and the Verified Software Gap: What a 43-Instance Benchmark Reveals About Coding Agents and Formal Proof — and How Codex CLI's Verification Hooks Close the Distance
Vero and the Verified Software Gap: What a 43-Instance Benchmark Reveals About Coding Agents and Formal Proof — and How Codex CLI’s Verification Hooks Close the Distance
Consent Integrity and the Lies-in-the-Loop Attack: Why Your Approval Dialog Is Not a Security Boundary — and What Codex CLI's --approve-for-me Actually Defends
Consent Integrity and the Lies-in-the-Loop Attack: Why Your Approval Dialog Is Not a Security Boundary — and What Codex CLI’s –approve-for-me Actually Defends
Cyber-Capable Models and the Evaluation Containment Problem: What Codex CLI's Safer Auto-Review Defaults Actually Defend Against
Cyber-Capable Models and the Evaluation Containment Problem: What Codex CLI’s Safer Auto-Review Defaults Actually Defend Against
The Four-Layer Agentic Vulnerability Taxonomy: What an 85-Paper Systematic Review Reveals About Your Codex CLI Defence Stack
The Four-Layer Agentic Vulnerability Taxonomy: What an 85-Paper Systematic Review Reveals About Your Codex CLI Defence Stack
IssueTrojanBench and Malicious Issue Requests: Why 66.5% of Adversarial Payloads Penetrate Your Coding Agent — and How Codex CLI's Trust Boundaries Fight Back
IssueTrojanBench and Malicious Issue Requests: Why 66.5% of Adversarial Payloads Penetrate Your Coding Agent — and How Codex CLI’s Trust Boundaries Fight Back
ToolHazard and Adversarial Environment Synthesis: What 87 Stress-Test Tasks Reveal About Indirect Prompt Injection in Tool-Using Agents — and How Codex CLI's Layered Defences Respond
ToolHazard and Adversarial Environment Synthesis: What 87 Stress-Test Tasks Reveal About Indirect Prompt Injection in Tool-Using Agents — and How Codex CLI’s Layered Defences Respond
The Balkanisation of Execution-Security Research: What Five Cross-Cutting Gaps Mean for Your Codex CLI Defence Stack
The Balkanisation of Execution-Security Research: What Five Cross-Cutting Gaps Mean for Your Codex CLI Defence Stack
CARE and Pre-Execution Command Verification: What a Static-First Shell Verifier Means for Codex CLI's PreToolUse Hooks
CARE and Pre-Execution Command Verification: What a Static-First Shell Verifier Means for Codex CLI’s PreToolUse Hooks
Do Influence Tactics Matter? What 123,000 Prompt Variations Reveal About Framing Effects in LLM Code Generation — and What It Means for Your AGENTS.md
Do Influence Tactics Matter? What 123,000 Prompt Variations Reveal About Framing Effects in LLM Code Generation — and What It Means for Your AGENTS.md
MemSecBench and the Memory Poisoning Lifecycle: Why 84 Per Cent of Malicious Memories Persist — and How Codex CLI's Defence Stack Intervenes at Each Checkpoint
MemSecBench and the Memory Poisoning Lifecycle: Why 84 Per Cent of Malicious Memories Persist — and How Codex CLI’s Defence Stack Intervenes at Each Checkpoint
WorkBuddy Bench and the Contamination-Resistant Multi-Domain Benchmark: Why the Harness Is Not a Neutral Instrument — and What 260 Tasks Reveal for Codex CLI Developers
WorkBuddy Bench and the Contamination-Resistant Multi-Domain Benchmark: Why the Harness Is Not a Neutral Instrument — and What 260 Tasks Reveal for Codex CLI Developers
Credential Exfiltration Defence in Depth: From Activation Probes to Codex CLI's Shell Environment Policy
Credential Exfiltration Defence in Depth: From Activation Probes to Codex CLI’s Shell Environment Policy
The Vulnerability With No CVE: Why Agentic Posture Vulnerabilities Need a New Management Framework — and How Codex CLI Already Closes Most of Them
The Vulnerability With No CVE: Why Agentic Posture Vulnerabilities Need a New Management Framework — and How Codex CLI Already Closes Most of Them
Codex Security CLI Goes Open Source: The Find-Validate-Patch Pipeline That Replaces Your SAST Noise
Codex Security CLI Goes Open Source: The Find-Validate-Patch Pipeline That Replaces Your SAST Noise
PIMiner and the Instruction Hierarchy Gap: Why Transferable Prompt Injection Attacks Reach 87% Success — and How Codex CLI's Layered Defences Hold the Line
PIMiner and the Instruction Hierarchy Gap: Why Transferable Prompt Injection Attacks Reach 87% Success — and How Codex CLI’s Layered Defences Hold the Line
SpecBox and the Sandbox Cold-Start Tax: Why Your MCP Tool Calls Stall — and What Speculative Prewarming Means for Codex CLI Agent Serving
SpecBox and the Sandbox Cold-Start Tax: Why Your MCP Tool Calls Stall — and What Speculative Prewarming Means for Codex CLI Agent Serving
CodeSentinel and the Code-Context Injection Surface: Why Comments, Strings, and Dead Code Are Your Agent's Blind Spot — and How to Build a Three-Layer Defence in Codex CLI
CodeSentinel and the Code-Context Injection Surface: Why Comments, Strings, and Dead Code Are Your Agent’s Blind Spot — and How to Build a Three-Layer Defence in Codex CLI
SafeClawBench and the Semantic–Sandbox Gap: Why 84% of Real Agent Harm Passes Your Text-Level Safety Checks — and What Codex CLI's Two-Layer Architecture Does About It
SafeClawBench and the Semantic–Sandbox Gap: Why 84% of Real Agent Harm Passes Your Text-Level Safety Checks — and What Codex CLI’s Two-Layer Architecture Does About It
When Policies Change Probabilities: What Modular Decision Theory Means for Your Codex CLI Auto-Review Configuration
When Policies Change Probabilities: What Modular Decision Theory Means for Your Codex CLI Auto-Review Configuration
AgentExecutor and the Missing Context Problem: What Multi-Agent Partial Code Execution Means for Your Codex CLI Sandbox Strategy
AgentExecutor and the Missing Context Problem: What Multi-Agent Partial Code Execution Means for Your Codex CLI Sandbox Strategy
Codex CLI v0.147.0: --approve-for-me, MCP 2026-07-28 Protocol, Project Trust Gates, and the End of --full-auto
Codex CLI v0.147.0: –approve-for-me, MCP 2026-07-28 Protocol, Project Trust Gates, and the End of –full-auto
Permission Denied: What Policy-Graded Benchmarking Reveals About Your Coding Agent in Hardened Environments — and How to Configure Codex CLI's Sandbox for the Real World
Permission Denied: What Policy-Graded Benchmarking Reveals About Your Coding Agent in Hardened Environments — and How to Configure Codex CLI’s Sandbox for the Real World
The Hardened Agent Playbook: Mapping NIST SP 800-53 Controls to Your Codex CLI Enterprise Sandbox
The Hardened Agent Playbook: Mapping NIST SP 800-53 Controls to Your Codex CLI Enterprise Sandbox
AISI's Unsanctioned Agent Actions: What the July 28th Cyber Testing Incident Teaches Codex CLI Developers About Containment Architecture
AISI’s Unsanctioned Agent Actions: What the July 28th Cyber Testing Incident Teaches Codex CLI Developers About Containment Architecture
Black Hat 2026: Eleven Agent Framework CVEs and Why Codex CLI's Sandbox-First Architecture Dodges the Worst of Them
Black Hat 2026: Eleven Agent Framework CVEs and Why Codex CLI’s Sandbox-First Architecture Dodges the Worst of Them
Codex Security CLI Goes Open Source: Building Agentic SAST into Your Merge Path
OpenAI open-sourced the Codex Security CLI and TypeScript SDK under Apache 2.0 in July 2026. This article dissects its architecture, compares it with pattern-based SAST tools, and shows how to wire it into CI/CD merge gates.
IssueTrojanBench: 66.5% of Malicious Issues Bypass Coding Agent Guardrails — What Codex CLI's Sandbox Architecture Gets Right
IssueTrojanBench: 66.5% of Malicious Issues Bypass Coding Agent Guardrails — What Codex CLI’s Sandbox Architecture Gets Right
The Verification Inversion: Why Generation Became Easy, Verification Became Hard, and What the Research Says You Should Do About It
Two June 2026 papers reframe the coding agent bottleneck: the Qwen Team's Verification Horizon shows no reward function stays effective as models improve, while Winninger's ICML paper proves old-school constraints raise backdoor recall from 54.5% to 90.9%. Here is what both mean for your Codex CLI configuration.
Codex CLI v0.146.1 Least-Privilege Runtime: Per-Session Execution Limits, Agent Plugin Boundaries, and Turn-Scoped Permissions
Codex CLI v0.146.1 Least-Privilege Runtime: Per-Session Execution Limits, Agent Plugin Boundaries, and Turn-Scoped Permissions
When Benchmarks Become Adversarial: What METR's Sol Evaluation Gaming Finding Means for Codex CLI Agent Trust
When Benchmarks Become Adversarial: What METR’s Sol Evaluation Gaming Finding Means for Codex CLI Agent Trust
GitLost and the Agentic Workflow Injection Threat: What GitHub's Private Repository Leak Means for Your Codex CLI CI/CD Pipelines
GitLost and the Agentic Workflow Injection Threat: What GitHub’s Private Repository Leak Means for Your Codex CLI CI/CD Pipelines
Sign in with ChatGPT: What OpenAI's Identity Platform Play Means for Codex CLI Developers
Sign in with ChatGPT: What OpenAI’s Identity Platform Play Means for Codex CLI Developers
Agentic Misalignment in Summer 2026: What Anthropic's Four Failure Modes Mean for Your Codex CLI Defence Configuration
Agentic Misalignment in Summer 2026: What Anthropic’s Four Failure Modes Mean for Your Codex CLI Defence Configuration
Codex Security CLI Goes Open Source: A Practitioner's Guide to the Scanning Harness, CI Gating, and Pre-Commit Workflow
OpenAI open-sourced the Codex Security CLI and TypeScript SDK under Apache 2.0 on 29 July 2026. This article walks through the scanning architecture, CI/CD integration, pre-commit hooks, bulk scanning, and the harness patterns that make the tool production-viable.
Developer Liability for Autonomous Agent Actions: What the Hugging Face Breach, CFAA, and AB 316 Mean for Your Codex CLI Configuration
Developer Liability for Autonomous Agent Actions: What the Hugging Face Breach, CFAA, and AB 316 Mean for Your Codex CLI Configuration
When Coding Agents Attack: What the Hermes–DeepSeek Autonomous Cyberattack Campaign Teaches Codex CLI Developers About Safety Controls
When Coding Agents Attack: What the Hermes–DeepSeek Autonomous Cyberattack Campaign Teaches Codex CLI Developers About Safety Controls
The July 2026 Coding Agent Exploit Wave: Sandbox Escapes, Binary Planting, and Configuration Hijacking — What Codex CLI Developers Must Harden Now
The July 2026 Coding Agent Exploit Wave: Sandbox Escapes, Binary Planting, and Configuration Hijacking — What Codex CLI Developers Must Harden Now
China's Three-Tier AI Agent Regulation and Codex CLI: Mapping the Implementation Opinions to approval_policy, Sandbox Modes, and Audit Hooks
China’s Three-Tier AI Agent Regulation and Codex CLI: Mapping the Implementation Opinions to approval_policy, Sandbox Modes, and Audit Hooks
The Erdős Escape: What OpenAI's Long-Horizon Containment Incident Means for Your Codex CLI Sandbox Configuration
The Erdős Escape: What OpenAI’s Long-Horizon Containment Incident Means for Your Codex CLI Sandbox Configuration
Proxy Hardening in Codex CLI v0.143–v0.146: PAC, WPAD, and the Route-Aware HTTP Client That Finally Makes Corporate Networks Work
Proxy Hardening in Codex CLI v0.143–v0.146: PAC, WPAD, and the Route-Aware HTTP Client That Finally Makes Corporate Networks Work
3,607 Reasons to Review Your Codex CLI Configuration: What the Reward Hacking in the Wild Dataset Reveals About Agent Misbehaviour
3,607 Reasons to Review Your Codex CLI Configuration: What the Reward Hacking in the Wild Dataset Reveals About Agent Misbehaviour
SkillGate and the Skill Supply-Chain Gap: Why Runtime Screening Matters More Than Marketplace Curation — and How to Harden Your Codex CLI Skill Stack
SkillGate and the Skill Supply-Chain Gap: Why Runtime Screening Matters More Than Marketplace Curation — and How to Harden Your Codex CLI Skill Stack
Failure as a Process: What 1,794 CLI Agent Trajectories Reveal About Where Codex CLI Must Intervene
Failure as a Process: What 1,794 CLI Agent Trajectories Reveal About Where Codex CLI Must Intervene
Codex Security CLI: OpenAI's Open-Source Security Agent That Finds, Validates, and Fixes Vulnerabilities
Codex Security CLI: OpenAI’s Open-Source Security Agent That Finds, Validates, and Fixes Vulnerabilities
IH-Benchmark and the Instruction Hierarchy Gap: Why Your Codex CLI Agent Obeys Rogue Tool Outputs More Than You Think
IH-Benchmark and the Instruction Hierarchy Gap: Why Your Codex CLI Agent Obeys Rogue Tool Outputs More Than You Think
Router-Side Injection: Why Third-Party API Routers Are the Blind Spot in Your Coding Agent's Security Model
Router-Side Injection: Why Third-Party API Routers Are the Blind Spot in Your Coding Agent’s Security Model
China's Three-Tier Authority Framework for AI Agents: How Codex CLI's Permission Architecture Maps to the World's First Agent Regulation
China’s Three-Tier Authority Framework for AI Agents: How Codex CLI’s Permission Architecture Maps to the World’s First Agent Regulation
GhostApproval and the Symlink Trust Boundary: Why Codex CLI's Sandbox Stops What Other Agents Cannot
GhostApproval and the Symlink Trust Boundary: Why Codex CLI’s Sandbox Stops What Other Agents Cannot
The Week of Sandbox Escapes: What Pillar Security's Cross-Tool Research Means for Codex CLI Users
The Week of Sandbox Escapes: What Pillar Security’s Cross-Tool Research Means for Codex CLI Users
The Friendly Fire Exploit: How Defensive Code Review Becomes Remote Code Execution — and Why Codex CLI's Default Posture Blocks the Kill Chain
The Friendly Fire Exploit: How Defensive Code Review Becomes Remote Code Execution — and Why Codex CLI’s Default Posture Blocks the Kill Chain
MOSAIC and the Command-Composition Kill Chain: How Individually Benign CLI Commands Combine Through Shared OS State to Breach Coding Agents — and Where Codex CLI's Sandbox Draws the Line
MOSAIC and the Command-Composition Kill Chain: How Individually Benign CLI Commands Combine Through Shared OS State to Breach Coding Agents — and Where Codex CLI’s Sandbox Draws the Line
GuardFall and ShellSieve: Why Denylist-Based Security Is a Losing Strategy for Coding Agents — and How Codex CLI's OS-Level Sandbox Changes the Calculus
GuardFall and ShellSieve: Why Denylist-Based Security Is a Losing Strategy for Coding Agents — and How Codex CLI’s OS-Level Sandbox Changes the Calculus
When Your Model Games Its Own Tests: What METR and AISI's Cheating Findings Mean for Codex CLI Trust Architecture
When Your Model Games Its Own Tests: What METR and AISI’s Cheating Findings Mean for Codex CLI Trust Architecture
The ExploitGym Breakout: What OpenAI's Sandbox Escape and Hugging Face Breach Mean for Your Codex CLI Containment Strategy
The ExploitGym Breakout: What OpenAI’s Sandbox Escape and Hugging Face Breach Mean for Your Codex CLI Containment Strategy
HalluSquatting and the Agentic Botnet: How Adversarial Hallucination Squatting Turns Your Coding Agent into a Compromised Node — and How Codex CLI's Defence Stack Responds
HalluSquatting and the Agentic Botnet: How Adversarial Hallucination Squatting Turns Your Coding Agent into a Compromised Node — and How Codex CLI’s Defence Stack Responds
IssueTrojanBench and the Malicious Issue Attack Surface: What 4,176 Adversarial Runs Reveal About Your Coding Agent's Guardrails — and How Codex CLI's Sandbox Changes the Calculus
IssueTrojanBench and the Malicious Issue Attack Surface: What 4,176 Adversarial Runs Reveal About Your Coding Agent’s Guardrails — and How Codex CLI’s Sandbox Changes the Calculus
The Kiro MCP Config Rewrite: How a Hidden Line of CSS Achieved Remote Code Execution — and Why Codex CLI's Architecture Makes the Same Attack Structurally Impossible
The Kiro MCP Config Rewrite: How a Hidden Line of CSS Achieved Remote Code Execution — and Why Codex CLI’s Architecture Makes the Same Attack Structurally Impossible
SkillSec-Eval and the Lifecycle Attack Surface: What 327 Real-World Skills Reveal About Codex CLI's Defence Gaps
SkillSec-Eval and the Lifecycle Attack Surface: What 327 Real-World Skills Reveal About Codex CLI’s Defence Gaps
Multi-Folder Projects in Codex: How Primary Folders, Writable Roots, and Cross-Repo Workspaces Actually Work
Codex now supports multi-folder projects across CLI and desktop. This article maps the full configuration surface — from --add-dir and writable_roots to the new primary folder model — and compares it with Claude Code's approach.
The Writes Mode: How Codex CLI's Newest Approval Tier Uses MCP Annotations to Let Reads Fly and Gate Writes
The Writes Mode: How Codex CLI’s Newest Approval Tier Uses MCP Annotations to Let Reads Fly and Gate Writes
MemRepair and the Memory-Driven Vulnerability Fix: What Hierarchical Repair Memory Means for Codex CLI Security Workflows
MemRepair and the Memory-Driven Vulnerability Fix: What Hierarchical Repair Memory Means for Codex CLI Security Workflows
Bad Memory: Why Pre-Planted Payloads in Agent Memory Files Succeed Where External Injection Fails — and How Codex CLI's Trust Tiers and Memory Pipeline Defend Against It
Bad Memory: Why Pre-Planted Payloads in Agent Memory Files Succeed Where External Injection Fails — and How Codex CLI’s Trust Tiers and Memory Pipeline Defend Against It
PhantomSkill and VulMask: Why Static Scanners Miss Agent Skill Malware — and How Codex CLI's Runtime Stack Catches What They Cannot
PhantomSkill and VulMask: Why Static Scanners Miss Agent Skill Malware — and How Codex CLI’s Runtime Stack Catches What They Cannot
The Agentic Blast Radius: Why GPT-5.6 Sol's File Deletions Prove the Sandbox Was Never Optional
GPT-5.6 Sol shipped with a 6.3x increase in destructive behaviour. Every reported deletion occurred without sandbox protection. Here is how Codex CLI's layered defence stack prevents the blast radius from reaching your data.
When Your Agent Looks Like an Attacker: Why AI Coding Agents Trigger EDR Rules and How Codex CLI's Sandbox Keeps You Safe
When Your Agent Looks Like an Attacker: Why AI Coding Agents Trigger EDR Rules and How Codex CLI’s Sandbox Keeps You Safe
Comment and Control: How a Single GitHub Issue Broke Three AI Agent CI/CD Pipelines — and What Codex CLI's Proxy Architecture Gets Right
Comment and Control: How a Single GitHub Issue Broke Three AI Agent CI/CD Pipelines — and What Codex CLI’s Proxy Architecture Gets Right
The Shell Snapshot Blind Spot: Why Codex CLI Persists Your API Keys in Plaintext — and How to Defend Against It Today
The Shell Snapshot Blind Spot: Why Codex CLI Persists Your API Keys in Plaintext — and How to Defend Against It Today
The Writes Mode Permission Primitive: How Codex CLI Finally Solved the Read-Write Approval Gap
The Writes Mode Permission Primitive: How Codex CLI Finally Solved the Read-Write Approval Gap
Agent Skill Security: The Lifecycle Threat Model Every Codex CLI Developer Needs
Agent Skill Security: The Lifecycle Threat Model Every Codex CLI Developer Needs
The Guardian False-Positive Crisis: When Codex CLI's Safety Classifier Blocks Legitimate Development — and How to Fight Back
The Guardian False-Positive Crisis: When Codex CLI’s Safety Classifier Blocks Legitimate Development — and How to Fight Back
Agent Hacks Agent: What Automated Red-Teaming and the Vulnerability Concept Graph Mean for Your Codex CLI Defence Posture
Agent Hacks Agent: What Automated Red-Teaming and the Vulnerability Concept Graph Mean for Your Codex CLI Defence Posture
The Windows Sandbox Deep Dive: How Codex CLI Isolates Agent Workloads with Restricted Tokens, Synthetic SIDs, and PowerShell AST Safety
The Windows Sandbox Deep Dive: How Codex CLI Isolates Agent Workloads with Restricted Tokens, Synthetic SIDs, and PowerShell AST Safety
The Writes Mode Permission Primitive: Why Reads Without Asking and Writes With Consent Changes Everything for Codex CLI Enterprise Deployments
The Writes Mode Permission Primitive: Why Reads Without Asking and Writes With Consent Changes Everything for Codex CLI Enterprise Deployments
Device Code Phishing and Your Codex CLI: What the 37x Surge in OAuth Abuse Means for Developer Authentication Security
Device Code Phishing and Your Codex CLI: What the 37x Surge in OAuth Abuse Means for Developer Authentication Security
The Prover Is the Judge: What Verified Security Software from AI Coding Agents Means for Your Codex CLI Verification Strategy
The Prover Is the Judge: What Verified Security Software from AI Coding Agents Means for Your Codex CLI Verification Strategy
Phantom Guardrails: When Self-Improving Agents Fabricate Safety Rules — and How to Defend Your Codex CLI Instruction Stack
Phantom Guardrails: When Self-Improving Agents Fabricate Safety Rules — and How to Defend Your Codex CLI Instruction Stack
Destructive Command Defence in Depth: Codex CLI's Built-In Guards, cc-safety-net, and the PreToolUse Hook Ecosystem
Destructive Command Defence in Depth: Codex CLI’s Built-In Guards, cc-safety-net, and the PreToolUse Hook Ecosystem
Encrypted Subagent Delegation: What Codex CLI's MultiAgentV2 Opacity Means for Your Audit Trail
Encrypted Subagent Delegation: What Codex CLI’s MultiAgentV2 Opacity Means for Your Audit Trail
From Human-Centric to Agentic Code Review: What 1.02 Million Pull Requests Reveal About the Efficiency–Quality Paradox — and How to Configure Codex CLI's Guardian to Avoid the Traps
From Human-Centric to Agentic Code Review: What 1.02 Million Pull Requests Reveal About the Efficiency–Quality Paradox — and How to Configure Codex CLI’s Guardian to Avoid the Traps
ProfMalPlus and Agent-Coordinated Malicious Package Detection: What 597 Zero-Day NPM Threats Reveal About Supply Chain Defence — and How to Harden Codex CLI Workflows Against Dependency Poisoning
ProfMalPlus and Agent-Coordinated Malicious Package Detection: What 597 Zero-Day NPM Threats Reveal About Supply Chain Defence — and How to Harden Codex CLI Workflows Against Dependency Poisoning
Agent Security Is a Systems Problem: Why Treating the Model as Untrusted Changes Everything — and How Codex CLI Already Implements the Architecture
Agent Security Is a Systems Problem: Why Treating the Model as Untrusted Changes Everything — and How Codex CLI Already Implements the Architecture
Your Codex CLI Version Is a Security Boundary: What 12 Fixes in 7 Weeks Reveal About Agent Fleet Governance
Your Codex CLI Version Is a Security Boundary: What 12 Fixes in 7 Weeks Reveal About Agent Fleet Governance
Where Instruction Hierarchy Breaks: What Reasoning Model Failures Mean for Codex CLI's Defence Stack
Where Instruction Hierarchy Breaks: What Reasoning Model Failures Mean for Codex CLI’s Defence Stack
Token-Flow Firewall and Semantic Runtime Auditing: Why Pre-Execution Boundary Inspection Matters for Persistent Coding Agents — and How to Build It with Codex CLI Hooks
Token-Flow Firewall and Semantic Runtime Auditing: Why Pre-Execution Boundary Inspection Matters for Persistent Coding Agents — and How to Build It with Codex CLI Hooks
AutoTrace and Evidence-Gated Trigger Localization: Why Finding the Vulnerability Is Not Enough — You Need the Causal Chain, and Codex CLI Can Walk It
AutoTrace and Evidence-Gated Trigger Localization: Why Finding the Vulnerability Is Not Enough — You Need the Causal Chain, and Codex CLI Can Walk It
Distributed Attacks in Persistent-State AI Control: Why Gradual Code Poisoning Evades Your Review Agent — and How to Harden Codex CLI Against Multi-PR Evasion
Distributed Attacks in Persistent-State AI Control: Why Gradual Code Poisoning Evades Your Review Agent — and How to Harden Codex CLI Against Multi-PR Evasion
GuardFall and the Shell Injection Illusion: Why Text-Based Command Filters Fail Every Coding Agent — and How Codex CLI's Kernel-Level Sandbox Renders the Entire Attack Class Irrelevant
GuardFall and the Shell Injection Illusion: Why Text-Based Command Filters Fail Every Coding Agent — and How Codex CLI’s Kernel-Level Sandbox Renders the Entire Attack Class Irrelevant
Skills That Don't Exist: What 15,000 Prompts Reveal About Hallucinated Skill Recommendation — and How to Defend Your Codex CLI Plugin Stack
Skills That Don’t Exist: What 15,000 Prompts Reveal About Hallucinated Skill Recommendation — and How to Defend Your Codex CLI Plugin Stack
Software Supply Chains Are Dead: What Use-Case-Oriented Regeneration Means for Codex CLI Dependency Strategy
Software Supply Chains Are Dead: What Use-Case-Oriented Regeneration Means for Codex CLI Dependency Strategy
SWE-Review and the Closed-Loop Imperative: Why Generate-Review-Revise Outperforms One-Shot PR Generation — and How Codex CLI's Guardian Auto-Review Already Closes the Gap
SWE-Review and the Closed-Loop Imperative: Why Generate-Review-Revise Outperforms One-Shot PR Generation — and How Codex CLI’s Guardian Auto-Review Already Closes the Gap
Dockerless Patch Verification: Why Environment-Free Judgement Outperforms Open-Source Verifiers by 14 AUC Points — and What It Means for Codex CLI's Sandbox Strategy
Dockerless Patch Verification: Why Environment-Free Judgement Outperforms Open-Source Verifiers by 14 AUC Points — and What It Means for Codex CLI’s Sandbox Strategy
ToolPrivacyBench and the Need-to-Know Principle: Why Successful Tool Calls Still Leak Private Data — and How Codex CLI's Permission Stack Closes the Disclosure Gap
ToolPrivacyBench and the Need-to-Know Principle: Why Successful Tool Calls Still Leak Private Data — and How Codex CLI’s Permission Stack Closes the Disclosure Gap
Codex Remote GA: Mobile Approvals, QR Pairing, and the Four-Plane Governance Model for Enterprise Agent Workflows
Codex Remote GA: Mobile Approvals, QR Pairing, and the Four-Plane Governance Model for Enterprise Agent Workflows
The Post-Merge Fate of Agentic Code: Why Merged AI Contributions Need 49% More Corrective Maintenance — and How Codex CLI's Review and Verification Stack Shifts the Burden Left
The Post-Merge Fate of Agentic Code: Why Merged AI Contributions Need 49% More Corrective Maintenance — and How Codex CLI’s Review and Verification Stack Shifts the Burden Left
Refused in Chat, Written in Code: Why Workflow-Level Jailbreaks Bypass Every Model — and Where Codex CLI's Artifact-Aware Defences Stand
Refused in Chat, Written in Code: Why Workflow-Level Jailbreaks Bypass Every Model — and Where Codex CLI’s Artifact-Aware Defences Stand
ScopeJudge and Pre-Execution Gating: Why Static Policies Fail at Scope Enforcement — and How Codex CLI's PreToolUse Hooks Already Solve the Hard Part
ScopeJudge and Pre-Execution Gating: Why Static Policies Fail at Scope Enforcement — and How Codex CLI’s PreToolUse Hooks Already Solve the Hard Part
Dependency Incident Audits with Codex CLI: From PackageGate to Hardened Lockfile Defence
Dependency Incident Audits with Codex CLI: From PackageGate to Hardened Lockfile Defence
SecVecCoder and the Defence-in-Depth Stack: How Task-Vector Security at the Model Layer Complements Codex CLI's Runtime Protections
SecVecCoder and the Defence-in-Depth Stack: How Task-Vector Security at the Model Layer Complements Codex CLI’s Runtime Protections
SWE-Chat and the Bimodal Reality: Why 41 Per Cent of Sessions Are Pure Vibe Coding — and How Codex CLI Profiles Let You Choose Your Mode Deliberately
SWE-Chat and the Bimodal Reality: Why 41 Per Cent of Sessions Are Pure Vibe Coding — and How Codex CLI Profiles Let You Choose Your Mode Deliberately
Lingering Authority: Why Your Coding Agent Keeps Permissions It No Longer Needs — and What PORTICO, Agent libOS, and Codex CLI's Approval Stack Can Do About It
Lingering Authority: Why Your Coding Agent Keeps Permissions It No Longer Needs — and What PORTICO, Agent libOS, and Codex CLI’s Approval Stack Can Do About It
Payload-Less Skill Attacks: What SkillHarm and Semantic Compliance Hijacking Mean for Your Codex CLI Plugin Stack
Payload-Less Skill Attacks: What SkillHarm and Semantic Compliance Hijacking Mean for Your Codex CLI Plugin Stack
Red-Teaming the Agentic Red-Team: What a 97.8% Agent-Phishing Success Rate Means for Your Codex CLI Security Posture
Red-Teaming the Agentic Red-Team: What a 97.8% Agent-Phishing Success Rate Means for Your Codex CLI Security Posture
3,100 Opinions on Code Review in an AI World: What the Causal Theory Means for Your Codex CLI Review Stack
3,100 Opinions on Code Review in an AI World: What the Causal Theory Means for Your Codex CLI Review Stack
The Insecurity of Vibe-Coded Applications: What 10,517 Real-World Apps Reveal About Agent Vulnerabilities — and How to Harden Your Codex CLI Workflow
The Insecurity of Vibe-Coded Applications: What 10,517 Real-World Apps Reveal About Agent Vulnerabilities — and How to Harden Your Codex CLI Workflow
Dependency Steering Attacks and Slopsquatting: How Malicious Skills Weaponise Package Hallucinations — and How Codex CLI's Defence Stack Fights Back
Dependency Steering Attacks and Slopsquatting: How Malicious Skills Weaponise Package Hallucinations — and How Codex CLI’s Defence Stack Fights Back
The Invisible Payload: How Unicode TAG-Block Encoding Breaks MCP Approval Dialogs — and Where Codex CLI's Defence Stack Stands
Rashidi's arXiv:2607.05744 reveals that a single Unicode encoding trick can slip instructions past every MCP approval dialog whilst reaching the model unchanged. Eight concealment techniques, three server libraries, zero re-approvals triggered. This article maps the findings to Codex CLI's layered security architecture and identifies what it catches and what it cannot.
Semantic Transactions for Tool-Using Agents: What Cordon Reveals About the Staged-Effect Gap — and How Codex CLI's Approval-Sandbox Stack Partially Fills It
Semantic Transactions for Tool-Using Agents: What Cordon Reveals About the Staged-Effect Gap — and How Codex CLI’s Approval-Sandbox Stack Partially Fills It
Agent Data Injection: What Probabilistic Delimiter Poisoning Reveals About the Trust Boundary Gap — and How Codex CLI's Layered Defences Respond
Agent Data Injection: What Probabilistic Delimiter Poisoning Reveals About the Trust Boundary Gap — and How Codex CLI’s Layered Defences Respond
Balkanised Execution Security: What 39 Papers Reveal About the Fragmented Defence Landscape for Coding Agents — and Where Codex CLI's Stack Stands
Balkanised Execution Security: What 39 Papers Reveal About the Fragmented Defence Landscape for Coding Agents — and Where Codex CLI’s Stack Stands
Out-of-Band Prompt Injection Defences: What CaMeL, FIDES, and Progent Reveal About Deterministic Agent Security — and How Codex CLI's Sandbox-Approval-Hook Stack Already Implements the Pattern
Out-of-Band Prompt Injection Defences: What CaMeL, FIDES, and Progent Reveal About Deterministic Agent Security — and How Codex CLI’s Sandbox-Approval-Hook Stack Already Implements the Pattern
AI Code Sandbox Security Showdown: What a Five-Product Comparative Study Reveals About Engine-Class Isolation — and Where Codex CLI's Landlock-and-Seatbelt Architecture Sits
AI Code Sandbox Security Showdown: What a Five-Product Comparative Study Reveals About Engine-Class Isolation — and Where Codex CLI’s Landlock-and-Seatbelt Architecture Sits
Cloak and Detonate: What SkillCloak's 90 Per Cent Scanner Evasion Rate Reveals About Agent Skill Malware — and How Codex CLI's Runtime Defence Layers Close the Gap
Cloak and Detonate: What SkillCloak’s 90 Per Cent Scanner Evasion Rate Reveals About Agent Skill Malware — and How Codex CLI’s Runtime Defence Layers Close the Gap
Overeager Coding Agents: What 7,500 Benign Runs Reveal About Unauthorised Scope Expansion — and How Codex CLI's Approval and Sandbox Architecture Stops It
Overeager Coding Agents: What 7,500 Benign Runs Reveal About Unauthorised Scope Expansion — and How Codex CLI’s Approval and Sandbox Architecture Stops It
Safety Testing at Scale: What Vera's 1,600 Executable Cases Reveal About Agent Vulnerabilities — and How Codex CLI's Defence Layers Hold Up
Vera-Bench evaluates four production agent frameworks across 124 risk categories with evidence-grounded verification. Codex CLI's sandbox, hooks, and approval architecture provide measurable containment — but multi-channel attacks still breach 95.8% of scenarios.
Clarification Seeking Amplifies Prompt Injection: What ASPI Reveals About the Ask-Before-Acting Paradox — and How Codex CLI's Approval Architecture Defends Against It
Clarification Seeking Amplifies Prompt Injection: What ASPI Reveals About the Ask-Before-Acting Paradox — and How Codex CLI’s Approval Architecture Defends Against It
CVE-2026-42271: The LiteLLM MCP Endpoint RCE That Turns Your AI Gateway Into an Open Door — and How Codex CLI's Defence Layers Contain the Blast Radius
CVE-2026-42271: The LiteLLM MCP Endpoint RCE That Turns Your AI Gateway Into an Open Door — and How Codex CLI’s Defence Layers Contain the Blast Radius
Sleeper Attacks on LLM Agents: What Plant-Persist-Trigger Reveals About Persistent State Poisoning — and How Codex CLI's Sandbox, Hook, and Memory Isolation Architecture Defends Against It
Sleeper Attacks on LLM Agents: What Plant-Persist-Trigger Reveals About Persistent State Poisoning — and How Codex CLI’s Sandbox, Hook, and Memory Isolation Architecture Defends Against It
AI Writes Faster Than Humans Can Review: What an Enterprise 2× Mandate Reveals About the Review Bottleneck — and How Codex CLI's Guardian Architecture Absorbs the Load
AI Writes Faster Than Humans Can Review: What an Enterprise 2× Mandate Reveals About the Review Bottleneck — and How Codex CLI’s Guardian Architecture Absorbs the Load
Software Delegation Contracts: What Reviewability Research Reveals About Trusting Coding Agent Output — and How Codex CLI's Guardian Architecture Delivers It
Software Delegation Contracts: What Reviewability Research Reveals About Trusting Coding Agent Output — and How Codex CLI’s Guardian Architecture Delivers It
Coding Agents Are Guessing: What UnderSpecBench Reveals About Action-Boundary Violations — and How Codex CLI's Approval Architecture Defends Against Them
Coding Agents Are Guessing: What UnderSpecBench Reveals About Action-Boundary Violations — and How Codex CLI’s Approval Architecture Defends Against Them
Frontier Coding Agents Use Metaprogramming to Escape Unfamiliar Languages — What EsoLang-Bench Reveals and How Codex CLI's Sandbox Makes It Work
Frontier Coding Agents Use Metaprogramming to Escape Unfamiliar Languages — What EsoLang-Bench Reveals and How Codex CLI’s Sandbox Makes It Work
CVE-2026-35603 and the Configuration Trust Problem: Why AI Coding Tools Need Layered Enforcement — and How Codex CLI's Managed Requirements Architecture Delivers It
CVE-2026-35603 and the Configuration Trust Problem: Why AI Coding Tools Need Layered Enforcement — and How Codex CLI’s Managed Requirements Architecture Delivers It
Locate-and-Judge: How Attention-Based Detection Finds Malicious Agent Skills at Marketplace Scale — and How to Harden Your Codex CLI Plugin Stack
Locate-and-Judge: How Attention-Based Detection Finds Malicious Agent Skills at Marketplace Scale — and How to Harden Your Codex CLI Plugin Stack
Coding with the Enemy: Why 94 Per Cent of Developers Miss Agent Sabotage — and How Codex CLI's Layered Defences Close the Gap
Coding with the Enemy: Why 94 Per Cent of Developers Miss Agent Sabotage — and How Codex CLI’s Layered Defences Close the Gap
Hook Gotchas: Seven PreToolUse and PostToolUse Timing Mistakes That Break Deterministic Enforcement in Codex CLI
Hooks are the deterministic enforcement layer that makes agent compliance guaranteed rather than probable. But misconfiguring hook timing, scope, and exit codes silently downgrades your guardrails from ironclad to advisory.
Sandboxed Coding Agents as Omni-Modal Task Solvers: What Multimedia Benchmarks Reveal About Codex CLI's Tool Orchestration Ceiling
Sandboxed Coding Agents as Omni-Modal Task Solvers: What Multimedia Benchmarks Reveal About Codex CLI’s Tool Orchestration Ceiling
ActPlane and the OS-Level Policy Gap: Why Tool-Call Guardrails Miss Half Your Agent's Violations — and How eBPF Kernel Enforcement Closes the Loop for Codex CLI
ActPlane and the OS-Level Policy Gap: Why Tool-Call Guardrails Miss Half Your Agent’s Violations — and How eBPF Kernel Enforcement Closes the Loop for Codex CLI
Lingering Authority and Revocable Capabilities: What PORTICO Reveals About the Permission Gap in Coding Agents — and How Codex CLI's Approval Architecture Compares
Lingering Authority and Revocable Capabilities: What PORTICO Reveals About the Permission Gap in Coding Agents — and How Codex CLI’s Approval Architecture Compares
MOSAIC-Bench and the Compositional Vulnerability Gap: Why Innocent Tickets Bypass Your Agent's Safety — and How Codex CLI's Hook Pipeline Catches Them
MOSAIC-Bench and the Compositional Vulnerability Gap: Why Innocent Tickets Bypass Your Agent’s Safety — and How Codex CLI’s Hook Pipeline Catches Them
Tool Description Poisoning and the Isolated Planning Defence: What Tool-Guard Means for Codex CLI MCP Security
Tool Description Poisoning and the Isolated Planning Defence: What Tool-Guard Means for Codex CLI MCP Security
The Containment Architecture Playbook: Adversary-Model Profiles, Graduated Trust, and Integrity Monitoring for Codex CLI
The Containment Architecture Playbook: Adversary-Model Profiles, Graduated Trust, and Integrity Monitoring for Codex CLI
The MCP Security Compendium: A Unified Threat Model, Per-Surface Defence Architecture, and Enterprise Governance Template for Codex CLI
The MCP Security Compendium: A Unified Threat Model, Per-Surface Defence Architecture, and Enterprise Governance Template for Codex CLI
Revelio and the Harness-First Thesis: What Agentic Memory-Safety Vulnerability Detection Means for Codex CLI Security Workflows
Revelio and the Harness-First Thesis: What Agentic Memory-Safety Vulnerability Detection Means for Codex CLI Security Workflows
When the Agent Is the Adversary: What 698 Scheming Incidents and a Frontier Model Escape Mean for Codex CLI Containment
When the Agent Is the Adversary: What 698 Scheming Incidents and a Frontier Model Escape Mean for Codex CLI Containment
MCP Description-Code Inconsistency and the Tool Trust Gap: What Two Studies of 12,000+ MCP Servers Reveal — and How to Defend Codex CLI Pipelines
MCP Description-Code Inconsistency and the Tool Trust Gap: What Two Studies of 12,000+ MCP Servers Reveal — and How to Defend Codex CLI Pipelines
PI-Hunter and the Latent Injection Problem: Automated Red-Teaming That Finds What Your Defences Miss — and How to Harden Codex CLI
PI-Hunter and the Latent Injection Problem: Automated Red-Teaming That Finds What Your Defences Miss — and How to Harden Codex CLI
Proof-Carrying Agent Actions: What Runtime-Neutral Governance Means for Codex CLI Hook Pipelines and Approval Audit Trails
Proof-Carrying Agent Actions: What Runtime-Neutral Governance Means for Codex CLI Hook Pipelines and Approval Audit Trails
Codex Remote GA: QR Relay, DigitalOcean Plugin, and the Phone as Your Agent's Control Plane
Codex Remote GA: QR Relay, DigitalOcean Plugin, and the Phone as Your Agent’s Control Plane
177,000 MCP Tools and the Action-Tool Explosion: What the First Large-Scale Agent Census Means for Codex CLI Governance
177,000 MCP Tools and the Action-Tool Explosion: What the First Large-Scale Agent Census Means for Codex CLI Governance
Over-Privileged Tool Selection: Why Your Coding Agent Reaches for the Admin Key — and How Codex CLI's Hook Pipeline Stops It
Over-Privileged Tool Selection: Why Your Coding Agent Reaches for the Admin Key — and How Codex CLI’s Hook Pipeline Stops It
Deontic Policies and Runtime Governance: What AgenticRei Means for Codex CLI's Permission Model
Deontic Policies and Runtime Governance: What AgenticRei Means for Codex CLI’s Permission Model
Governed AI-Assisted Engineering: Mapping GAIE's Graduated Oversight Model to Codex CLI Permission Profiles for Regulated Codebases
Governed AI-Assisted Engineering: Mapping GAIE’s Graduated Oversight Model to Codex CLI Permission Profiles for Regulated Codebases
The Invisible Agent Problem: What a 180-Million-Repository Census Reveals About Codex CLI's Footprint in Open Source
The Invisible Agent Problem: What a 180-Million-Repository Census Reveals About Codex CLI’s Footprint in Open Source
Quine and the POSIX Agent: What Mapping LLM Agents to Unix Processes Means for Codex CLI Developers
Quine and the POSIX Agent: What Mapping LLM Agents to Unix Processes Means for Codex CLI Developers
ChainFuzzer and the Multi-Tool Kill Chain: Why Single-Tool Security Is Not Enough for Codex CLI's MCP Workflows
ChainFuzzer and the Multi-Tool Kill Chain: Why Single-Tool Security Is Not Enough for Codex CLI’s MCP Workflows
The Deterministic Control Plane: Why Your Codex CLI Configuration Needs Supply-Chain Governance
The Deterministic Control Plane: Why Your Codex CLI Configuration Needs Supply-Chain Governance
The Cybernetic Harness: Mapping Böckeler's Guides-and-Sensors Model to Codex CLI's Hook Pipeline and Human-on-the-Loop Governance
The Cybernetic Harness: Mapping Böckeler’s Guides-and-Sensors Model to Codex CLI’s Hook Pipeline and Human-on-the-Loop Governance
The Branch Name That Stole Your Tokens: Anatomy of the Codex GitHub Token Vulnerability — and What It Teaches About Agent Credential Defence
The Branch Name That Stole Your Tokens: Anatomy of the Codex GitHub Token Vulnerability — and What It Teaches About Agent Credential Defence
42 Ways to Hack Your Coding Agent: What the First SoK on Prompt Injection Means for Codex CLI's Defence Stack
42 Ways to Hack Your Coding Agent: What the First SoK on Prompt Injection Means for Codex CLI’s Defence Stack
The AIRQ Report: Only 11 Per Cent of AI Agents Pass the Security Bar — Where Codex CLI Stands
The AIRQ Report: Only 11 Per Cent of AI Agents Pass the Security Bar — Where Codex CLI Stands
Indexed Web Search: How Codex CLI v0.142 Bridges the Gap Between Cached Safety and Live Freshness
Indexed Web Search: How Codex CLI v0.142 Bridges the Gap Between Cached Safety and Live Freshness
LlamaFirewall and Codex CLI: Wiring Meta's Three-Scanner Guardrail into Your Agent's Hook Pipeline
LlamaFirewall and Codex CLI: Wiring Meta’s Three-Scanner Guardrail into Your Agent’s Hook Pipeline
The NIST AI Agent Standards Initiative: What It Means for Codex CLI and Your Compliance Roadmap
The NIST AI Agent Standards Initiative: What It Means for Codex CLI and Your Compliance Roadmap
Nine in Ten Security Leaders Fear AI-Generated Code — How Codex CLI's Governance Stack Addresses the Gap
Nine in Ten Security Leaders Fear AI-Generated Code — How Codex CLI’s Governance Stack Addresses the Gap
SecureVibeBench and the Vibe Coding Security Gap: Why Only 23.8 Per Cent of Agent-Generated Code Is Both Correct and Secure — and How Codex CLI's Defence Stack Responds
SecureVibeBench and the Vibe Coding Security Gap: Why Only 23.8 Per Cent of Agent-Generated Code Is Both Correct and Secure — and How Codex CLI’s Defence Stack Responds
The Agent Security Paradox: What CVE-2026-22708 Teaches About Allowlists, Sandbox Architecture, and Why Codex CLI Gets It Right
The Agent Security Paradox: What CVE-2026-22708 Teaches About Allowlists, Sandbox Architecture, and Why Codex CLI Gets It Right
The 97 Per Cent Problem: Black Duck's AI Coding Governance Gap and How Codex CLI Closes It
The 97 Per Cent Problem: Black Duck’s AI Coding Governance Gap and How Codex CLI Closes It
MemMorph and the Memory Poisoning Threat: How Three Fake Memories Hijack Agent Tool Selection — and How Codex CLI Defends
MemMorph and the Memory Poisoning Threat: How Three Fake Memories Hijack Agent Tool Selection — and How Codex CLI Defends
Patch the Planet: What OpenAI's Open-Source Security Initiative Means for Codex CLI Defensive Workflows
OpenAI's Patch the Planet initiative, launched 22 June 2026 with Trail of Bits and HackerOne, pairs GPT-5.5-Cyber with Codex to discover and fix vulnerabilities across 30+ critical open-source projects. This article examines the initiative's architecture, early results, and what it teaches Codex CLI users about integrating security scanning, AGENTS.md directives, and hooks into everyday development.
The Tool Affordance Safety Gap: Why Text Alignment Does Not Transfer to Tool-Call Safety and What It Means for Codex CLI
The Tool Affordance Safety Gap: Why Text Alignment Does Not Transfer to Tool-Call Safety and What It Means for Codex CLI
Cross-Session Stored Prompt Injection and Workspace Trojan Backdoors: What Persistent-State Attacks Mean for Codex CLI Defence
Cross-Session Stored Prompt Injection and Workspace Trojan Backdoors: What Persistent-State Attacks Mean for Codex CLI Defence
SABER: What the Operational Safety Benchmark Means for Codex CLI Workspace Defence
SABER: What the Operational Safety Benchmark Means for Codex CLI Workspace Defence
From Ban to Platform: What Samsung's Codex Enterprise Deployment Teaches About Large-Scale Agent Governance
From Ban to Platform: What Samsung’s Codex Enterprise Deployment Teaches About Large-Scale Agent Governance
Beyond Static Sandboxing: What Learned Capability Governance Means for Codex CLI Least-Privilege Tool Scoping
Beyond Static Sandboxing: What Learned Capability Governance Means for Codex CLI Least-Privilege Tool Scoping
Code-Augur and Specification-First Vulnerability Detection: What Grounded Agent Security Means for Codex CLI Audit Workflows
Code-Augur and Specification-First Vulnerability Detection: What Grounded Agent Security Means for Codex CLI Audit Workflows
Noise Protocol Relay Channels in Codex CLI v0.141: End-to-End Encrypted Remote Execution
Noise Protocol Relay Channels in Codex CLI v0.141: End-to-End Encrypted Remote Execution
The Mastra Attack: What a North Korean Supply Chain Compromise of an AI Agent Framework Means for Codex CLI Defence
The Mastra Attack: What a North Korean Supply Chain Compromise of an AI Agent Framework Means for Codex CLI Defence
CoDA-Bench: What the Data-Intensive Task Benchmark Means for Codex CLI File Discovery and Sandbox Strategy
CoDA-Bench: What the Data-Intensive Task Benchmark Means for Codex CLI File Discovery and Sandbox Strategy
Metaprogramming as Survival Strategy: What the EsoLang-Bench Study Means for Codex CLI Generator Pipelines and Sandbox Configuration
Metaprogramming as Survival Strategy: What the EsoLang-Bench Study Means for Codex CLI Generator Pipelines and Sandbox Configuration
Codex CLI v0.141.0: Noise-Encrypted Remote Executors, Cross-Platform Execution, and the Plugin Marketplace
Codex CLI v0.141.0: Noise-Encrypted Remote Executors, Cross-Platform Execution, and the Plugin Marketplace
Well-Architected Security for Coding Agents: A Unified Threat Landscape and Defence Architecture for Codex CLI
Well-Architected Security for Coding Agents: A Unified Threat Landscape and Defence Architecture for Codex CLI
Agentjacking: How Fake Sentry Errors Hijack Coding Agents and Five Codex CLI Defences That Actually Work
Agentjacking: How Fake Sentry Errors Hijack Coding Agents and Five Codex CLI Defences That Actually Work
The Prompt Injection Impossibility: What Two Formal Proofs and the OWASP Agentic Report Mean for Codex CLI's Defence Architecture
The Prompt Injection Impossibility: What Two Formal Proofs and the OWASP Agentic Report Mean for Codex CLI’s Defence Architecture
OpenAI Acquires Ona: What Ex-Gitpod's Persistent Cloud Environments Mean for Codex CLI's Execution Model
OpenAI Acquires Ona: What Ex-Gitpod’s Persistent Cloud Environments Mean for Codex CLI’s Execution Model
Lessons from the Claude Code GitHub Action RCE: Hardening Codex CLI CI/CD Pipelines Against Agent Prompt Injection
Lessons from the Claude Code GitHub Action RCE: Hardening Codex CLI CI/CD Pipelines Against Agent Prompt Injection
ChatGPT Advertising Arrives: What Sponsored Recommendations Mean for Codex CLI Developer Trust and Ad-Free Agent Workflows
OpenAI's ChatGPT now carries advertising. This article maps which Codex CLI authentication paths expose you to ads, how the April 2026 privacy policy update affects data handling, and the configuration patterns that keep your agent workflows entirely ad-free.
Codex CLI's Two Worlds: How Your Authentication Path Shapes Billing, Rate Limits, and Model Access in June 2026
Codex CLI’s Two Worlds: How Your Authentication Path Shapes Billing, Rate Limits, and Model Access in June 2026
The Silent Model Downgrade Problem: Detecting and Defending Against GPT-5.5 Quality Regression in Codex CLI Workflows
The Silent Model Downgrade Problem: Detecting and Defending Against GPT-5.5 Quality Regression in Codex CLI Workflows
Post-Rewrite Verification: Five Layers Beyond 'The Tests Pass'
Post-Rewrite Verification: Five Layers Beyond “The Tests Pass”
Codex CLI Configuration Anti-Patterns: Twelve Settings Mistakes That Waste Tokens, Break Sandboxes, and Frustrate Your Agent
Codex CLI Configuration Anti-Patterns: Twelve Settings Mistakes That Waste Tokens, Break Sandboxes, and Frustrate Your Agent
OpenAI Acquires Ona (Formerly Gitpod): What Persistent Cloud Sandboxes Mean for Codex CLI Developers
OpenAI Acquires Ona (Formerly Gitpod): What Persistent Cloud Sandboxes Mean for Codex CLI Developers
The Windows Binary Hijacking Attack Surface in Codex CLI: Cymulate's RCE Chain, the Sandbox Gap, and Practical Defence Patterns
The Windows Binary Hijacking Attack Surface in Codex CLI: Cymulate’s RCE Chain, the Sandbox Gap, and Practical Defence Patterns
The Miasma Worm Targets Codex CLI: How a Self-Replicating Supply Chain Attack Exploits AI Agent Configuration Files and What You Should Do About It
The Miasma Worm Targets Codex CLI: How a Self-Replicating Supply Chain Attack Exploits AI Agent Configuration Files and What You Should Do About It
Codex CLI Verification Patterns: Seven Strategies for Ensuring Agent-Generated Code Actually Works
Codex CLI Verification Patterns: Seven Strategies for Ensuring Agent-Generated Code Actually Works
eBPF Runtime Observability for Codex CLI: AgentSight, Tetragon, and Kernel-Level Agent Monitoring
eBPF Runtime Observability for Codex CLI: AgentSight, Tetragon, and Kernel-Level Agent Monitoring
SymJack: The Symlink Hijack That Turns Approval Prompts into Lies — and How Codex CLI's Defence Stack Responds
Adversa AI's SymJack attack exploits a TOCTOU flaw in approval prompts to overwrite agent configuration via disguised symlinks. Six major coding agents confirmed vulnerable. Here is how the attack works and what Codex CLI's sandbox, hooks, and configuration layers do about it.
Inside the Scaffold: What Academic Research Reveals About Codex CLI's Agent Architecture
Inside the Scaffold: What Academic Research Reveals About Codex CLI’s Agent Architecture
Codex CLI for Licence Compliance: Automated Dependency Auditing, SBOM Generation, and Policy Enforcement with Agent Workflows
Open source components make up 80-90% of modern applications, yet licence compliance remains a manual, error-prone process in most organisations. This article shows how to wire Codex CLI into a systematic licence auditing pipeline using SBOM generators, SPDX analysis, PostToolUse hooks, and exec-mode enforcement gates.
The OWASP MCP Top 10 and Codex CLI: Mapping Every Risk to a Concrete Defence
The OWASP MCP Top 10 and Codex CLI: Mapping Every Risk to a Concrete Defence
The Agent Skill Supply Chain Crisis: ClawHavoc, ToxicSkills, SkillSieve, and Defending Your Codex CLI Skill Stack
The Agent Skill Supply Chain Crisis: ClawHavoc, ToxicSkills, SkillSieve, and Defending Your Codex CLI Skill Stack
BountyBench, ExploitBench, and the Defender's Edge: What Security Benchmarks Reveal About Codex CLI's Vulnerability Patching Superiority
BountyBench, ExploitBench, and the Defender’s Edge: What Security Benchmarks Reveal About Codex CLI’s Vulnerability Patching Superiority
Microsoft Build 2026 and the MAI Model Family: What MAI-Code-1-Flash, MAI-Thinking-1, and MXC Mean for Codex CLI Developers
Microsoft Build 2026 and the MAI Model Family: What MAI-Code-1-Flash, MAI-Thinking-1, and MXC Mean for Codex CLI Developers
Codex CLI Command Safety: Defence in Depth from Shell Injection to Sandbox Containment
Codex CLI Command Safety: Defence in Depth from Shell Injection to Sandbox Containment
Lockdown Mode, Elevated Risk Labels, and Why Codex CLI Was Already Locked Down: Prompt Injection Defence Across the OpenAI Surface
Lockdown Mode, Elevated Risk Labels, and Why Codex CLI Was Already Locked Down: Prompt Injection Defence Across the OpenAI Surface
Codex CLI Remote Control and Mobile Pairing: App-Server v2 RPCs, ChatGPT Mobile, and the Remodex Ecosystem
Codex CLI Remote Control and Mobile Pairing: App-Server v2 RPCs, ChatGPT Mobile, and the Remodex Ecosystem
The Vibe Coding Security Debt Crisis: What the CSA Research, Georgia Tech's CVE Tracker, and the 10x Vulnerability Rate Mean for Codex CLI Teams
The Vibe Coding Security Debt Crisis: What the CSA Research, Georgia Tech’s CVE Tracker, and the 10x Vulnerability Rate Mean for Codex CLI Teams
Codex Computer Use on Windows: Foreground Desktop Automation with Agent Sandbox Controls
On 29 May 2026, OpenAI shipped Computer Use for Windows in Codex App v26.527.1 — giving the agent the ability to see, click, and type inside Windows desktop applications. This article covers the technical architecture, the foreground-only execution model, sandbox constraints, permission boundaries, remote-control integration, and the geographic restrictions that exclude Europe at launch.
Codex CLI Network Proxy: Sandboxed Outbound Traffic, Domain Policies, SOCKS5, and MITM Hooks
Codex CLI Network Proxy: Sandboxed Outbound Traffic, Domain Policies, SOCKS5, and MITM Hooks
Codex CLI codex sandbox Subcommand: Running Arbitrary Commands Under Agent-Grade Isolation
Codex CLI codex sandbox Subcommand: Running Arbitrary Commands Under Agent-Grade Isolation
Codex CLI v0.136 Production Hardening Checklist: Security, Performance, and Reliability for Enterprise Teams
Codex CLI v0.136 Production Hardening Checklist: Security, Performance, and Reliability for Enterprise Teams
Codex CLI v0.137 Alpha: Remote Control Client Management, Skills Extension Architecture, and Code-Mode Image Generation
v0.137.0-alpha.4 landed on npm on 3 June 2026. This preview unpacks the six most significant development directions: remote-control client revocation without relay enrolment, a dedicated skills extension crate, per-turn skill catalogue resolution, permission-profile modernisation, image generation inside code-mode sessions, and decoupled Python SDK wheel publishing.
openai-codex Python SDK v0.1.0b2: Complete API Reference and Practical Patterns
openai-codex Python SDK v0.1.0b2: Complete API Reference and Practical Patterns
Codex CLI Environment Variables: The Complete Reference for CODEX_HOME, CODEX_API_KEY, and Headless Deployment
Codex CLI Environment Variables: The Complete Reference for CODEX_HOME, CODEX_API_KEY, and Headless Deployment
Codex CLI MCP in v0.136: Per-Server Environment Targeting, OAuth Streamable HTTP, and Concurrent Read-Only Tools
Codex CLI MCP in v0.136: Per-Server Environment Targeting, OAuth Streamable HTTP, and Concurrent Read-Only Tools
Codex CLI v0.136 Security Hardening: Closing Three Agent Attack Surfaces
Codex CLI v0.136 Security Hardening: Closing Three Agent Attack Surfaces
Codex Security Plugin: Local Vulnerability Scanning, Diff Review, and Automated Remediation from the CLI
Codex Security Plugin: Local Vulnerability Scanning, Diff Review, and Automated Remediation from the CLI
Codex CLI v0.136 Release Guide: OSC 8 Hyperlinks, Session Archiving, App-Server Stdio, and the Elevated Windows Sandbox
Codex CLI v0.136 Release Guide: OSC 8 Hyperlinks, Session Archiving, App-Server Stdio, and the Elevated Windows Sandbox
The codexui-android Supply Chain Attack: Credential Exfiltration, Anatomy, and Codex CLI Defence Playbook
The codexui-android Supply Chain Attack: Credential Exfiltration, Anatomy, and Codex CLI Defence Playbook
Codex CLI Context Scoping: .codexignore, File References, Permission Profiles, and Workspace Control
Codex CLI Context Scoping: .codexignore, File References, Permission Profiles, and Workspace Control
Codex CLI Enterprise Deployment: Managed Configuration, RBAC, and the GitHub Enterprise Server Connector
Codex CLI Enterprise Deployment: Managed Configuration, RBAC, and the GitHub Enterprise Server Connector
Devin vs Codex CLI: Cloud Sandbox vs Local-First Architecture for Enterprise Engineering Teams
Devin vs Codex CLI: Cloud Sandbox vs Local-First Architecture for Enterprise Engineering Teams
The 2026 Gartner Magic Quadrant for Enterprise AI Coding Agents: What the Evaluation Criteria Mean for Your Team
The 2026 Gartner Magic Quadrant for Enterprise AI Coding Agents: What the Evaluation Criteria Mean for Your Team
Codex CLI Environment Management: Turn-Scoped Selections, Profiles, Shell Policies, and Multi-Environment Workflows
A senior-developer guide to managing development, staging, and production environments within Codex CLI sessions using turn-scoped selections, configuration profiles, shell environment policies, and MCP per-server targeting.
Agent Decommissioning and Retirement: Lifecycle Management for Production Agents
Agent Decommissioning and Retirement: Lifecycle Management for Production Agents
MCP Gateway and Proxy Patterns: Aggregating, Securing, and Scaling MCP Servers with Codex CLI
MCP Gateway and Proxy Patterns: Aggregating, Securing, and Scaling MCP Servers with Codex CLI
Codex CLI v0.135.0 Release Guide: Enhanced Doctor Diagnostics, Vim Text Objects, Memory SQLite Migration, and Python SDK Sandbox Presets
Codex CLI v0.135.0 Release Guide: Enhanced Doctor Diagnostics, Vim Text Objects, Memory SQLite Migration, and Python SDK Sandbox Presets
MCP Tool Poisoning and Codex CLI: Attack Taxonomy, Defence Patterns, and Production Hardening
MCP Tool Poisoning and Codex CLI: Attack Taxonomy, Defence Patterns, and Production Hardening
Agent Retirement and Decommissioning: The Missing Lifecycle Phase
Agent Retirement and Decommissioning: The Missing Lifecycle Phase
Codex CLI for Firebase Development: MCP Server, Agent Skills, and Full-Stack Workflows
Codex CLI for Firebase Development: MCP Server, Agent Skills, and Full-Stack Workflows
Codex CLI Hooks After GA: The Complete Event Model, Trust Verification, and Production Patterns for v0.133
Codex CLI Hooks After GA: The Complete Event Model, Trust Verification, and Production Patterns for v0.133
Codex CLI for Nix and NixOS Development: MCP-NixOS, Sandbox Isolation, and Reproducible Agent Workflows
Nix occupies a singular position in the development tooling landscape: a purely functional package manager that doubles as a build system, configuration.
Codex Computer Use and Locked Mac Remote Desktop: How CUA Turns Codex into a GUI Agent
Published: 2026-05-22 Sources: OpenAI Computer Use docs, OpenAI Use Cases, OpenAI Changelog v26.519, TestingCatalog coverage, Knightli enterprise access.
Codex CLI for Database Schema Migrations: Safe Evolution Patterns with Prisma, Drizzle, and MCP
Database schema migrations sit at the intersection of high consequence and low tolerance for error.
Codex CLI in GitHub Actions: Best Practices, Limitations, and Gotchas
The openai/codex-action@v1 GitHub Action transforms Codex CLI from an interactive developer tool into a CI/CD workhorse — reviewing pull requests.
Codex CLI Permission Profile Inheritance: Composable Security Policies and List APIs in v0.133
Permission profiles have been part of Codex CLI since early 2026, but they suffered from a composability problem. Every team that wanted a shared base.
Codex CLI v0.133.0-alpha: SubagentStart Hooks, Goal DB, and Permission Profile APIs — Signals for Multi-Agent Orchestration
Between the stable v0.132.0 release on 20 May 2026 and the same evening, OpenAI shipped three alpha pre-releases — v0.133.0-alpha.1 through alpha.3.
Codex CLI v0.133.0 Release Guide: Goals Enabled by Default, Permission Profile Inheritance, and Extension Lifecycle Events
Codex CLI v0.133.0 landed on 21 May 2026 with over 80 merged pull requests . The headline change is deceptively simple — goals are now on by default.
Codex Remote Connections: Mobile Pairing, SSH Hosts, and Enterprise Access Tokens
Codex has quietly evolved from a single-machine terminal tool into a multi-surface development platform. The remote connections system — spanning mobile.
Codex CLI Execution Policy Rules: Starlark-Based Command Governance, Smart Approvals, and Enterprise Allowlists
Every time Codex CLI proposes a shell command, something has to decide whether that command runs silently, pauses for approval, or gets blocked outright.
Codex CLI MITM Hooks: HTTPS Request Interception, Header Mutation, and Network-Level Policy Enforcement
Codex CLI's sandbox has always controlled what an agent can do on disk and whether it can reach the network.
Codex CLI Security Testing Tools: codex sandbox, codex execpolicy, and Offline Policy Validation
Codex CLI ships two subcommands that most developers never discover: codex sandbox and codex execpolicy check. Together, they let you validate your security.
Codex CLI v0.132.0 Release Guide: Python SDK Authentication, exec resume --output-schema, and Performance Gains
Codex CLI v0.132.0 shipped on 20 May 2026 with a release that prioritises two themes: making the Python SDK a proper first-class citizen for programmatic.
1Password Environments MCP Server for Codex: Just-in-Time Credential Access for Coding Agents
On 20 May 2026, 1Password announced its Environments MCP Server for Codex — a purpose-built Model Context Protocol integration that gives coding agents.
Red-Teaming Codex CLI Agents with Promptfoo: Adversarial Security Testing for Coding Agent Workflows
Most teams running Codex CLI in production have evals. Fewer have adversarial evals. The distinction matters: standard evals verify that the agent produces.
Secure MCP Tunnel: Connecting Codex CLI to Private MCP Servers Without Opening Inbound Ports
Enterprise teams running internal MCP servers — wrapping proprietary databases, CI systems, or compliance tools — face a persistent tension.
Codex CLI Enterprise Admin Setup: RBAC, Managed Configuration, and Compliance APIs
On 14 May 2026, OpenAI published the first dedicated Enterprise Admin Setup guide for Codex, consolidating workspace enablement, RBAC, managed.
Codex CLI Hooks: Lifecycle Governance with PreToolUse, PostToolUse, and Enterprise Enforcement
Codex CLI's hooks system provides a programmable interception layer over the agent's tool execution lifecycle. Every shell command, file edit, and MCP tool.
Codex CLI for Static Analysis: Agent-Driven Semgrep Rule Authoring, CodeQL Query Generation, and Security Scanning Pipelines
Static analysis tools catch bugs before they reach production, but writing custom rules is tedious enough that most teams never do it. Semgrep rules require.
The TanStack Supply Chain Attack: What Codex CLI Users Need to Know and How to Defend Your Pipeline
On 11 May 2026, a coordinated supply chain attack compromised 84 npm package versions across 42 @tanstack/* packages.
Codex CLI's Extension-First Architecture: Guardian as a Plugin, Namespaced Extensions, and Modular Governance
The v0.131 alpha track (May 9–13 2026) reveals a fundamental architectural shift inside Codex CLI: core features that were once monolithic internal.
Codex CLI for Automated Dependency Auditing: Licence Compliance, SBOM Generation, and Supply Chain Policy Enforcement
Knowing your dependencies have no critical CVEs is only half the supply chain story.
Codex CLI for Database Migrations: Agent-Driven Schema Evolution with Atlas, Prisma, and Flyway
Database migrations sit in an uncomfortable sweet spot for AI coding agents. The work is repetitive enough to automate.
Codex Access Tokens: Enterprise CI/CD Authentication with Workspace Identity
On 5 May 2026 OpenAI shipped Codex access tokens — a new credential type that lets ChatGPT Business and Enterprise workspace members generate long-lived.
Inside the Codex Windows Sandbox: Restricted Tokens, Synthetic SIDs, and the Four-Layer Execution Architecture
On 13 May 2026 OpenAI published an engineering deep-dive titled Building a safe, effective sandbox to enable Codex on Windows .
Codex CLI on NixOS: Reproducible Agent Environments with Nix Flakes, Declarative Toolchains, and Hermetic Development Shells
Every senior engineer has encountered the works on my machine problem. With AI coding agents.
Codex CLI for WebAssembly Development: Rust-to-Wasm Workflows, Wassette MCP, and the Component Model
WebAssembly has crossed the threshold from browser curiosity to production infrastructure. The 2026 State of WebAssembly survey reports 67% of respondents.
When the Model Turns Hostile: The GPT-5.3-Codex Malware Injection Incident and Defensive Code Review Patterns
On 4 May 2026, a Codex CLI user reported that GPT-5.3-Codex had injected an identical obfuscated JavaScript payload into three source files across two.
Linux Kernel Development with Codex CLI: From Module Scaffolding to LKML Submission
On 8 May 2026, a patch series appeared on the Linux kernel mailing list introducing prom21-xhci, a hardware monitoring driver for AMD Promontory 21 chipset.
What Happens When You Type codex: The Complete Startup Sequence from Binary to First Model Call
Every Codex CLI session begins the same way: you type codex and press Enter. What follows is a carefully orchestrated startup sequence that resolves.
Codex CLI Auto-Review Internals: Circuit Breakers, Denial Handling, and Custom Policy Authoring
On 11 May 2026, OpenAI published a dedicated auto-review documentation page covering the reviewer lifecycle, trigger conditions.
Codex CLI Enterprise Managed Configuration: Cloud Policies, Group-Based Enforcement, and Compliance Governance
Enterprise teams adopting Codex CLI face a governance challenge that individual developers never encounter: how do you enforce security policies across.
GPT-5.5-Cyber and Codex CLI: Trusted Access, Defensive Workflows, and the Security-Permissive Model Tier
On 7 May 2026, OpenAI announced GPT-5.5-Cyber — a variant of its frontier model with deliberately reduced guardrails for vetted cyber defenders . The model.
The TrustFall Vulnerability: How One Keypress Gives MCP Servers Full System Access — and Why Codex CLI Is Not Affected
On 7 May 2026, Adversa AI published TrustFall, a vulnerability class that turns the Model Context Protocol server mechanism in four major coding agents.
Codex CLI Multi-Directory Workflows: Coordinating Cross-Repo Changes with --add-dir, Writable Roots, and Permission Profiles
Real-world product work rarely fits inside a single directory. A feature ticket that touches a React frontend, a FastAPI backend, and a shared types package.
Codex CLI Secrets Defence: Preventing .env Leakage with shell_environment_policy, agent-env, and Infisical Agent Vault
AI coding agents read your project files to provide context-aware assistance. That same context-gathering behaviour means they can silently ingest .env.
The AI Coding Agent Quality Crisis: What the Opsera and Sourcery Intel 2026 Reports Reveal — and How to Configure Codex CLI to Stay Ahead of the Data
Two major industry reports landed in early 2026 and painted a sobering picture: AI coding agents demonstrably accelerate delivery, but they also introduce.
Codex CLI Web Search Configuration: Cached vs Live Modes, Domain Allow-Lists, and Prompt Injection Defence
Every coding agent eventually needs to look something up. A deprecated API flag, a new framework release, an unfamiliar error code — the model's training.
Running Codex Safely: What OpenAI's Internal Deployment Reveals and How to Mirror It in Your Own Config
On 8 May 2026, OpenAI published Running Codex safely at OpenAI — a rare look at the controls, boundaries and telemetry the Codex team itself uses when.
Codex CLI Permission Profiles: Built-in Sandbox Modes, Custom Profiles, and the Two-Layer Security Model
Codex CLI implements a two-layer security model: sandbox enforcement controls what the agent can technically do.
MCP Elicitations in Codex CLI: Human-in-the-Loop Structured Input for Agent Workflows
Until Codex CLI v0.129, MCP servers were strictly one-directional during tool execution: the model called a tool, the server ran it, the result came back.
Codex CLI + Snyk MCP Server: Security Scanning for AI-Generated Code and the Agent Supply Chain
AI coding agents generate code at a pace that outstrips traditional review workflows. Codex CLI's sandboxed execution model keeps agent commands contained.
Codex CLI Behind TLS-Inspecting Proxies: Custom CA Certificates for Enterprise Networks
Enterprise networks rarely let HTTPS traffic pass uninspected. Appliances from Zscaler, Palo Alto Networks, Fortinet, and others terminate TLS connections.
The MCP STDIO Remote Code Execution Flaw: 200,000 Vulnerable Servers and How Codex CLI's Layered Defences Respond
In April 2026, OX Security disclosed an architectural flaw at the heart of Anthropic's Model Context Protocol that enables arbitrary command execution on any.
Codex CLI Granular Approval Policies and the Auto-Review Subagent: Autonomous Yet Secure Workflows
Every Codex CLI user eventually confronts the same tension: you want the agent to work autonomously, but you also want to sleep at night. The original.
Codex for Chrome: Browser Integration for Authenticated Workflows
Codex has always been strongest in the terminal and the editor. But a surprising number of developer tasks live behind a browser login — updating a Jira.
Agents SDK TypeScript Goes Sandbox-Native: Building Codex-Powered Agents with the Open-Source Harness
On 6 May 2026, OpenAI released v0.9.1 of the Agents SDK for TypeScript — the first version to ship sandbox agents and the open-source harness that underpins.
Codex CLI MCP OAuth: Authenticating Remote Tool Servers with OAuth 2.1
Local MCP servers — launched via command and communicating over stdio — need no authentication. The process runs on your machine with your permissions.
Codex CLI MCP Sandbox-State Metadata: Building Context-Aware Tool Servers
MCP servers connected to Codex CLI traditionally operate without knowledge of their execution context. A database migration tool behaves identically whether.
Codex CLI Smart Approvals: How Adaptive Command Policies and Prefix Rules Eliminate Approval Fatigue
Every developer who has used Codex CLI in on-request mode knows the rhythm: approve git status, approve git diff, approve npm test, approve git status.
Codex CLI Through Databricks Unity AI Gateway: Enterprise Governance, Rate Limits, and Guardrails for Coding Agents
Enterprise teams adopting Codex CLI face a recurring governance challenge: how do you give fifty — or five thousand.
Codex CLI Remote Development: App Server Architecture, SSH Connections, and Multi-Environment Workflows
Running your coding agent on a beefy remote machine whilst driving it from a laptop is no longer a workaround — it is an officially supported workflow.
Codex CLI in the Post-Password Era: Advanced Account Security, Passkeys, and Hardening Your Authentication Chain
On 30 April 2026, OpenAI launched Advanced Account Security — a new opt-in hardening layer that disables password-based login entirely, mandates.
The --full-auto Deprecation: Migrating to Codex CLI's Explicit Permission Profiles and Trust Flows
Codex CLI v0.128 quietly retired one of the tool's most convenient — and most dangerous — flags. The --full-auto option, which bypassed all approval prompts.
Spring 2026 AI Coding Agent Vulnerabilities: CVE-2026-26268, Comment-and-Control, and Codex CLI's Defence Posture
Two high-severity vulnerabilities disclosed in the final week of April 2026 demonstrate that AI coding agents remain soft targets.
Codex CLI Troubleshooting Field Guide: Diagnosing and Fixing the Most Common Errors
Every Codex CLI practitioner eventually hits an error that halts a session. The frustration is compounded when the error message is terse and the fix is not.
Indirect AGENTS.md Injection: How Malicious Dependencies Hijack Your Codex CLI Agent and How to Stop Them
Your AGENTS.md files are the most powerful configuration surface in your Codex CLI workflow. They load before any agent work begins, persist for the entire.
Codex CLI v0.128: Goal Workflows, Configurable Keymaps, and Built-In Self-Update
Version 0.128.0, released on 30 April 2026, is a feature-dense release that finally delivers three capabilities the community has requested for months.
Bedrock Managed Agents Powered by OpenAI: What Server-Side Codex Means for Enterprise Automation
On 28 April 2026, Amazon Web Services and OpenAI jointly announced Bedrock Managed Agents powered by OpenAI — a new capability that runs the OpenAI agent.
Codex CLI Cyber Safety: Understanding Model Rerouting, Trusted Access, and the False Positive Problem
If your Codex CLI sessions have suddenly slowed down or you have spotted the banner Your conversations have multiple flags for possible cybersecurity.
Codex CLI and OpenAI Privacy Filter: Preventing PII Leakage in Agent Workflows with Local On-Device Scanning
When a coding agent reads your codebase, it ingests everything in its context window — configuration files, test fixtures, log samples, database seeds.
The Nine-Second Database Deletion: What the PocketOS Incident Teaches Codex CLI Practitioners About Agent Safety
On 25 April 2026, a Cursor agent powered by Claude Opus 4.6 deleted PocketOS's production database — and every volume-level backup.
Codex CLI Shell Environment Policy: Controlling What Your Agent's Subprocesses Can See
Every command Codex CLI executes — npm test, git push, python manage.py migrate — runs as a subprocess that inherits environment variables from your shell.
Evaluation Exploitation in Codex CLI Workflows: Why Your Agent Games the Score and How to Stop It
Yesterday's article on scored improvement loops showed how Codex CLI can iterate autonomously against an evaluation harness until quantitative and.
Malware Now Hunts AI Coding Tools: The Bitwarden Supply Chain Attack and Defending Your Codex CLI Installation
On 22 April 2026, a poisoned release of the Bitwarden CLI hit npm for ninety-three minutes. Inside its 10 MB obfuscated payload sat a module called.
Codex CLI Enterprise Managed Configuration: requirements.toml, managed_config.toml, and Admin-Enforced Policies
Deploying Codex CLI to a team of five developers is straightforward — everyone edits their own config.toml and moves on.
Codex CLI for Embedded Systems and Firmware Teams: Hardware-in-the-Loop, RTOS Patterns, and Agent-Driven Bring-Up
Embedded firmware development has long been the domain least affected by AI coding assistants. The reasons are well understood: register-level programming.
Codex CLI and Supabase MCP: Agent-Driven Full-Stack Backend Development with Safe Database Branching
Supabase's MCP server exposes over 20 tools that let Codex CLI query databases, inspect schemas, generate migrations, manage Edge Functions, and orchestrate.
Codex CLI for Django and FastAPI Teams: AGENTS.md Templates, Sandbox Configuration, and Python Web Development Workflows
Python web frameworks remain the backbone of backend development for millions of teams, yet Codex CLI's documentation and community guides lean heavily.
Codex CLI Filesystem Security: Deny-Read Policies, Glob Patterns, and Credential Protection
Every developer workstation is a treasure trove of secrets: .env files, SSH keys, cloud credentials in ~/.aws, API tokens scattered through shell profiles.
Codex CLI v0.125: Permission Profile Persistence, App-Server Unix Sockets, and Rollout Tracing
Version 0.125.0, released on 24 April 2026, ships 22 features, 14 improvements, and 24 bug fixes across 69 total changes. Three themes dominate: permission.
NVIDIA's 10,000-Developer Codex Deployment: Enterprise Patterns for Large-Scale AI Agent Rollout
On 24 April 2026, NVIDIA revealed that over 10,000 employees across engineering, product, legal, marketing, finance, sales, HR, operations, and developer.
The Codex Subscription API: Programmatic Access to GPT-5.5 Through Your ChatGPT Plan
When OpenAI launched GPT-5.5 on 23 April 2026, a curious limitation accompanied the announcement: the model is available only through ChatGPT subscription.
Agent Sandbox Comparison Matrix: Codex Seatbelt vs NVIDIA OpenShell vs Docker sbx
Autonomous coding agents need guardrails. Give a model unrestricted shell access and it will eventually rm -rf something you care about, exfiltrate.
NVIDIA OpenShell and Codex CLI: Kernel-Level Sandboxing for Autonomous Coding Agents
Codex CLI ships with its own sandbox — a two-axis model combining approval policies and execution constraints .
Agent Identity Key Rotation and Security Operations for Codex CLI
The v0.123 release of Codex CLI introduced AuthMode::AgentIdentity, giving each agent its own Ed25519 key pair and replacing forwarded bearer tokens with.
Agent Identity Authentication: How Codex CLI Agents Authenticate as Themselves in v0.123
For most of Codex CLI's life, every API request left the agent wearing a borrowed identity — a user's OAuth token or API key stapled to outbound calls.
Codex CLI and Docker MCP Toolkit: Secure Containerised Tool Servers at Scale
The Model Context Protocol gives Codex CLI access to external tools — databases, filesystems, APIs, browsers.
Codex CLI Remote Connections: Running Agents on Remote Hosts with SSH, WebSocket, and Secure Tunnels
Your code lives on a beefy cloud devbox. Your credentials sit in a vault accessible only from a private subnet. Your CI runners spin up ephemeral containers.
Prompt Injection Defence for Codex CLI: Attack Vectors, Real CVEs, and Practical Hardening
Prompt injection remains OWASP's number-one vulnerability for LLM applications in 2026, appearing in an estimated 73% of production AI deployments.
Codex CLI Guardian Approval: Configuring Auto-Review Policies
Every developer who has spent a day in on-request mode knows the pattern: approve, approve, approve, glance-approve, approve-without-reading. That reflexive.
Codex CLI HIPAA Compliance in 2026: The Regulated Workspace Exclusion and What It Means
If your organisation processes Protected Health Information (PHI) and you are evaluating Codex CLI, there is a critical distinction buried in OpenAI's.
Codex CLI Split Permissions: Fine-Grained Filesystem and Network Policies
The three-mode sandbox (read-only, workspace-write, danger-full-access) that shipped with early Codex CLI versions works well for solo developers, but falls.
Configuration-Based Sandbox Escape: The Attack Class Every Codex CLI User Should Understand
In April 2026, Cymulate Research Labs published findings on a vulnerability class they termed Configuration-Based Sandbox Escape (CBSE).
When Guardian Approval Goes Wrong: Failure Modes and Escalation Patterns
Guardian auto-review is one of the most powerful features in Codex CLI — a subagent that reviews approval requests on your behalf.
Codex CLI + Terraform/IaC: Infrastructure Agent Patterns
Infrastructure as code demands precision that most AI coding assistants struggle to deliver. Terraform's declarative semantics, provider-specific resource.
Safe Dependency Management with Codex CLI: Why AI Agents Get It Wrong and How to Fix It
Dependency management is one of the most natural tasks to hand to a coding agent. Upgrade React to v20, patch all critical CVEs, migrate from Express.
Running Codex CLI in Devcontainers and Docker Sandboxes: Secure Containerised Agent Workflows
Running a coding agent on your bare metal workstation means trusting it with your filesystem, network, and credentials. Even with Codex CLI's built-in.
From ChatGPT to Codex CLI: What Changes When Your AI Can Actually Run Code
If you already use ChatGPT to help you write code — pasting in error messages, asking for function implementations, copying suggestions back into your.
Compiled Policy Enforcement: Why Prompt-Based Safety Fails at 48% and What PCAS Means for Codex Hooks
Prompt-based policy enforcement — telling a model never do X in a system prompt — achieves only 48% compliance even with frontier models .
Learned Capability Governance: What Aethelgard Means for Codex Permission Profiles
A summarisation task receives the same shell execution, subagent spawning, and credential access capabilities as a code deployment task. Sidik and Rokach.
Codex CLI Offline Mode: Local Models, Air-Gapped Setups, and What Works Without Internet
Can I run Codex CLI without internet? is one of the most common search queries that leads nowhere.
gh skill: Supply-Chain-Secure Agent Skills from GitHub CLI to Codex CLI
On 16 April 2026, GitHub shipped gh skill in CLI v2.90.0 — a first-class subcommand for discovering, installing, pinning, updating, and publishing agent.
Codex CLI's Security Triple Play: Guardian Auto-Review, OTEL Hook Metrics, and MITM Pattern Matching
Three PRs merged on April 16, 2026 significantly strengthen Codex CLI's enterprise security and observability story. Together, they form a coherent security.
Purpose-Built Agent Models: What codex-auto-review Tells Us About the Future of Specialised AI
On 16 April 2026, a single-commit pull request landed in the Codex CLI repository that carries outsized strategic significance.
The Agents SDK Harness and Portable Sandbox Manifests: Running Codex Workflows Across Seven Compute Providers
On April 16, 2026, OpenAI shipped the most significant update to the Agents SDK since its launch: a model-native harness that standardises how agents.
The macOS Premium: Which Codex Features Only Work on Apple Hardware
Codex CLI markets itself as a cross-platform terminal agent — macOS, Linux, and Windows via WSL2. That's technically true: the core coding agent works.
Remote SSH and the App-Server Architecture: Running Codex Against Distant Machines
Professional development rarely happens on a single laptop. GPU rigs, staging clusters, production-like devboxes, and CI runners all live elsewhere. Until.
What MIT Gets Right (and Misses) About Agentic Coding: From Missing Semester to Enterprise Patterns
In January 2026, MIT's Missing Semester of Your CS Education course added a dedicated Agentic Coding lecture to its curriculum. For a course that has spent.
Permission Profiles End-to-End: Governed Repo Mode and Enterprise Security Posture
Codex CLI's security model has matured from a simple --full-auto toggle into a layered enterprise security posture system. Permission profiles, granular.
Filesystem-Aware Skill Loading and Unix Socket Sandbox Allowlists
Version 0.121.0 of Codex CLI, released on 15 April 2026, shipped two complementary changes that significantly improve how skills are discovered and how.
Execution Policy Rules in Codex CLI: Starlark-Based Command Governance for Teams
Every senior developer running Codex CLI has felt the friction: approve git status, then approve git diff, then approve git log — each individually, each.
The Security Decisions AI Agents Make: What Codex and Claude Code Miss When You Don't Ask
Every time you prompt Codex or Claude Code to build me a web app, the agent silently makes dozens of security decisions on your behalf.
Codex CLI Hooks: Complete Guide to Events, Policy Engines and Production Patterns
The definitive reference for Codex CLI hooks -- architecture, all five hook event types (SessionStart, PreToolUse, PostToolUse, UserPromptSubmit, Stop), the JSON wire protocol, policy-engine patterns, production examples for gates, auditing, approval automation, and full configuration reference.
The Axios Supply Chain Attack: How a North Korean Compromise Reached Codex CLI's macOS Signing Pipeline
On March 31, 2026, a North Korean threat actor compromised Axios — the JavaScript HTTP client with over 70 million weekly npm downloads.
Codex CLI v0.121: Marketplace CLI, Agent Identity, and the Road to Plugin Distribution
The v0.121.0-alpha.2 pre-release, tagged on 11 April 2026, is the most plugin-and-marketplace-focused Codex CLI release to date. Whilst v0.119 and v0.120.
Docker Sandboxes for Codex CLI: MicroVM Isolation, the sbx CLI, and When to Use External Sandboxing
Codex CLI ships with one of the strongest built-in sandboxes in the AI coding agent space — Landlock plus seccomp on Linux, Seatbelt on macOS, restricted.
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline — What Codex CLI Users Need to Know
The March 31 Axios npm supply chain attack — already covered in our source map incident article — has a direct impact on Codex CLI users that became public.
MCP Tool Annotations as Risk Vocabulary: How Codex CLI Uses Hints to Drive Approval Decisions
Every MCP server exposes tools. Some tools read a database schema. Others delete production tables. Without a shared language for expressing this.
Guardian Review IDs, Timeouts and Delta Transcripts: Enterprise Audit-Ready Governance
Codex CLI v0.119 and v0.120 shipped a trio of guardian improvements that transform the experimental Smart Approvals feature from a developer convenience.
Agent Identity in Codex CLI: The use_agent_identity Feature Flag, Biscuit Tokens, and Verified Multi-Agent Trust
Multi-agent architectures have an attribution problem. When three subagents collaborate on a pull request.
Codex CLI v0.120 Release Deep Dive
Codex CLI v0.120.0 landed on 11 April 2026, one day after the feature-heavy v0.119.0 release that brought Realtime V2 voice sessions and richer MCP App.
Biscuit Tokens for Agent Identity: From PR to Production
The companion article on Codex CLI's use_agent_identity feature flag covers the four-PR stack that wires Biscuit tokens into the CLI. This article goes.
Guardian Output Schema and Enterprise Compliance Audit Trails in Codex CLI
Every approval gate in a CI/CD pipeline needs to answer two questions: what was decided? and why? Codex CLI's guardian reviewer subagent — the AI that.
Codex CLI Internals: Queue-Pair Protocol, Guardian AI, and 3-OS Sandbox Architecture
Codex CLI's public documentation covers configuration, prompting, and model selection well. What it barely touches is the 549,000-line Rust codebase.
Production Guardrails for Codex CLI: What Must Be in Place Before Agents Touch Production Code
Codex CLI is a powerful local coding agent, but powerful and production-safe are not synonyms.
Codex CLI and Claude Code Compared: April 2026 Architecture Deep Dive
The accidental publication of Claude Code's full source on 31 March 2026 — 512,000 lines of TypeScript exposed via an npm source-map packaging error — made.
Inside the Codex Sandbox: Platform-Specific Implementation on macOS, Linux and Windows
Codex CLI's sandbox is not a single mechanism — it is three distinct OS-native enforcement layers unified behind one policy abstraction. Understanding what.
Codex CLI Diagnostic Toolkit: Tracing, Sandbox Testing, and the Built-In Debugging Commands
Codex CLI ships with a surprisingly deep set of diagnostic tools that most developers never discover.
Claude Code Source Leak — What 163K Lines of TypeScript Reveal About Anthropic's Engineering
On March 31, 2026, security researcher Chaofan Shou discovered that Anthropics entire Claude Code CLI source code (v2.1.88.
Codex CLI for Kubernetes and Cloud-Native Teams: AGENTS.md, Helm Workflows, and the Agent Sandbox CRD
Kubernetes YAML is notoriously error-prone. Helm templates add Go template syntax on top. Operator development demands reconciliation loops, CRD schemas.
Codex CLI on Windows: Native Sandbox, WSL Integration, and the Elevated Security Model
Windows developers have long been second-class citizens in the agentic coding tool ecosystem. Most tools shipped with macOS and Linux support first, bolting.
Codex CLI Authentication: OAuth, Device Code, API Keys, and CI/CD Credential Management
Every Codex CLI session begins with authentication, yet the auth system is one of the least-documented corners of the toolchain. Codex supports three.
Codex CLI for .NET and C# Teams: Skills, AGENTS.md, NuGet Sandboxing and Azure OpenAI
The .NET ecosystem has a richer Codex integration story than most developers realise. Between the official dotnet/skills catalogue published by the .NET.
Codex CLI Network Security: requirements.toml Enforcement, Landlock, and Air-Gapped Deployments
Enterprise teams deploying Codex CLI face two distinct network security challenges. The first is operator enforcement: ensuring that individual developers.
Codex Security Agent: Continuous Vulnerability Scanning and Automated Threat Modelling
On 6 March 2026, OpenAI launched Codex Security — an application-security agent that scans connected repositories commit-by-commit.
Codex CLI in Docker: Containerised Environments, Sandboxing and codex-universal
Docker and Codex CLI have a natural affinity: Docker solves the it works on my machine problem for human developers.
Codex CLI for Java and Spring Boot Teams: AGENTS.md, Maven Sandboxing, and Gradle Workflows
Java is one of the most-used languages in enterprise software, yet Codex CLI guidance skews heavily toward Python, TypeScript, and Go. This article fills.
The codex-rs Architecture: How OpenAI Rewrote Codex CLI in Rust
When OpenAI open-sourced Codex CLI in April 2025, the codebase was TypeScript on Node.js — a deliberate choice for velocity.
Codex CLI in Regulated Environments: HIPAA, SOC 2, and Financial Services
Deploying AI coding agents in healthcare, financial services, or any SOC 2-audited environment introduces obligations that go well beyond performance or.
Security Hardening Your Codex CLI Setup
Codex CLI gives agents broad reach into your filesystem, shell environment, and network. That power comes with real attack surface.