On 11 November 2026, security firm Depi disclosed a critical vulnerability pathway in OpenAI’s Codex repository that highlights the growing attack surface of AI agents in CI/CD pipelines. The issue originated in a GitHub Actions workflow designed to label new issues, where the agent directly processed user-generated text from issue titles and bodies. This configuration allowed for prompt injection, potentially granting an attacker access to credentials capable of publishing malicious versions of the @openai/codex npm package. While no malicious release reached users, the chain was demonstrated in a test environment, prompting OpenAI to deploy an immediate fix and award a $1,000 initial bounty.

The Exploit Chain and Scope

Researchers Pierre Martin (Worty) and Garance de la Brosse (Madder) identified that the workflow trusted text from any user who could open an issue, passing it directly into the agent’s prompt without sufficient sanitization or privilege separation. The core danger lay in the potential for this injected instruction to manipulate the agent’s behavior within an environment that shared tokens, caches, or permissions with the release pipeline. Depi reported the chain via Bugcrowd with a full proof of concept, noting that @openai/codex is downloaded millions of times a month, amplifying the potential impact of a supply chain compromise. SecurityWeek confirmed the fix on 13 November, emphasizing that the vulnerability was a prompt injection in a GitHub Actions workflow rather than a flaw in the model itself.

Implications for Agent Security

This incident serves as a stark warning for developers and agencies integrating AI agents into their infrastructure. When an agent reads issues, comments, or pull request descriptions, it must be treated as untrusted input, not just data. The convenience of automated triage and labeling must not come at the cost of security hygiene, particularly regarding token permissions and cache sharing. If a labeler job and a release job share a cache or credentials, a low-privilege workflow can become a vector for high-privilege compromise. The lesson is clear: AI agents are only as secure as the tools, credentials, and input boundaries defined around them.

Key Takeaways

  • Audit workflows that pass external text (issues, comments) to AI agents, treating all such input as untrusted.
  • Enforce least privilege by using read-only tokens for triage and labeling jobs, separating them from release permissions.
  • Isolate privileged release workflows from shared caches that less-trusted workflows can write to.
  • Pin and review all GitHub Actions dependencies to prevent unauthorized changes in the execution environment.

The Bottom Line

Prompt injection in CI/CD is a supply chain risk, not just a chatbot bug. If your agents touch untrusted text, your release pipeline is only as secure as your workflow isolation.