OpenAI Codex can be hijacked by files left from an earlier agent run: why it is not safe to use

What happened

A Black Hat USA 2026 disclosure, reported on August 7, 2026, described a Codex workflow issue in GitHub automation. In the reported setup, two Codex passes ran in one job and shared the same checkout, which is the local copy of the repository files. The first pass could create a file called `AGENTS.md`. The second pass would then load that file as instructions.

The key point is that this did not require a CVE, which is a formal public identifier for a security flaw. Instead, it came from how the workflow was arranged. According to the report, OpenAI responded by separating the two passes into different jobs and recommending that Codex run as the last step, with a read-only sandbox, which means it cannot change files, and with drop-sudo, which means not giving it administrator-level privileges.

What it means for you

For a normal person using an AI coding agent, the warning is simple. Files in a repo can silently become instructions for a later Codex run. If one agent step can leave behind files, a later step may follow them without you noticing.

What to do instead

Keep agent runs separate when possible. Avoid reusing the same workspace for multiple passes. Treat instruction files in a repo as active inputs, not just notes. If available, run Codex last, use read-only settings, and avoid admin privileges. Review what files an earlier step can create before a later step starts. If you use AgentPod, note that it lists only reviewed, tested skills, but that does not remove the need to check how your workflow handles files and permissions.

Sources:

• https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html?m=0
• https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-coding-agent-ci-prompt-injection-202608/