VULNERABILITY IN OPENAI CODING AGENT COULD FACILITATE ATTACKS ON DEVELOPERS

Summary from the TLDR InfoSec newsletter

A command-injection vulnerability in OpenAI's Codex CLI allows trusted local configuration files to execute attacker-controlled commands without user approval. By slipping malicious configs into a repository, an attacker could gain remote access, run arbitrary commands, steal secrets, and even poison supply chains via CI and build systems. OpenAI fixed the issue in Codex CLI version 0.23.0 after disclosure.