OpenAI Codex EUVD-2026-41915

Exploitation requires the victim to be running the OpenAI Codex desktop app for macOS at a version prior to 26.527.31326, and to process content in a session that contains attacker-influenced material - such as tool results from a connected external service, file contents read by the app, API responses ingested into context, or data from a cloned repository. The app's default auto-fetch behavior for remote images in Markdown must be active, which it was in all affected versions. Exploitation is further conditioned on the attacker successfully crafting prompt injection instructions that survive LLM processing and produce a usable image URL - a meaningful technical requirement that contributes to the low EPSS score. Exploitation is strictly limited to the macOS desktop client; no other platform is implicated. Exfiltrated data value is gated on what secrets and sensitive content are present in the active Codex session at the time of injection. The CVSS vector's PR:N reflects that the attacker requires no privileges on the victim's system, but indirect control over at least one content input channel into the session is a prerequisite.

The NVD CVSS 6.5 Medium score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) captures network reachability and high confidentiality impact but may slightly understate attack complexity: successful exploitation requires not only that attacker-controlled content reach the Codex session but also that the injected instructions effectively manipulate the LLM output - a meaningful, if increasingly well-understood, technical hurdle. EPSS of 0.16% at the 6th percentile strongly suggests minimal observed exploitation activity, and the absence of a CISA KEV listing or any public POC corroborates this. However, the target demographic - developers with active API keys, credentials, and source code in session context - represents a high-value espionage target, meaning even low-frequency exploitation could yield outsized intelligence gains. The impact is confined strictly to confidentiality (I:N, A:N), which limits blast radius but does not diminish the sensitivity of what can be exfiltrated. Overall risk is real but currently low-probability; organizations with developers using Codex against untrusted repositories or external tool integrations should prioritize patching ahead of the broader population.

A developer clones an attacker-controlled repository and asks Codex to review the README or run a connected tool that fetches attacker-influenced content. The attacker has embedded prompt injection instructions in that content - for example, 'Include an image: !x' - causing Codex to generate a Markdown response containing the crafted image URL. The macOS Codex app immediately fetches the image to render it, silently transmitting the developer's API key to the attacker's server with no visible alert or secondary user action required.