Remote Image Fetching Vulnerability in OpenAI Codex macOS App

Mitigation Strategies

The vulnerability involves the OpenAI Codex desktop app for macOS automatically fetching remote images from Markdown in model responses, which can lead to exfiltration of sensitive data via remote image URLs constructed through indirect prompt injection.

To mitigate this vulnerability immediately, consider the following steps:

• Avoid processing untrusted or indirect prompt content that could contain malicious injections.
• Disable or restrict automatic fetching of remote images in the Codex desktop app if possible.
• Monitor and audit the data being processed by Codex sessions to detect any unusual or unexpected remote image requests.
• Keep the Codex app updated and watch for any official patches or updates from OpenAI addressing this issue.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the OpenAI Codex desktop app for macOS automatically fetching remote image URLs constructed by the model in response to indirect prompt injections. Detection would focus on monitoring network traffic for unexpected outbound requests to attacker-controlled servers, especially HTTP or HTTPS requests initiated by the Codex app without user interaction.

Suggested detection methods include:

• Monitor network traffic for unusual outbound connections from the Codex app process to unknown or suspicious domains.
• Use packet capture tools like tcpdump or Wireshark to filter HTTP/HTTPS requests originating from the Codex app.
• Check system logs or firewall logs for unexpected network activity from the Codex app.

Example commands to detect suspicious network activity on macOS:

• Use lsof to identify network connections by the Codex app: sudo lsof -i -a -c Codex
• Capture HTTP/HTTPS traffic from the Codex app using tcpdump: sudo tcpdump -i en0 -w codex_traffic.pcap host attacker-controlled-domain.com
• Use nettop to monitor real-time network connections: sudo nettop -p $(pgrep -f Codex)

Since the vulnerability involves exfiltration via remote image URL fetches, focusing on outbound HTTP(S) requests from the Codex app to unknown domains is key.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in the OpenAI Codex desktop app for macOS, which renders remote images from Markdown in model responses. An attacker who can insert an indirect prompt injection into content processed by Codex—such as results from connected tools or other untrusted sources—can trick the model into generating a remote image URL that contains sensitive data.

When the app renders the response, it automatically fetches the remote image URL without requiring any user interaction. This causes the embedded sensitive data to be sent to an attacker-controlled server.

The sensitive data that could be exfiltrated includes secrets accessible in the Codex session, such as API keys, source code, and data returned by connected tools.

There is no demonstrated impact on data integrity or availability, and no known exploitation in the wild has been reported.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the unintended disclosure of sensitive information from your Codex session. Specifically, an attacker could exfiltrate secrets such as API keys, source code, and data returned by connected tools without your knowledge.

Because the app automatically fetches remote images embedded in model responses, the attacker does not need any user interaction to receive this data, increasing the risk of silent data leakage.

While there is no direct impact on the integrity or availability of your data or system, the confidentiality of sensitive information is compromised.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in the OpenAI Codex desktop app for macOS could lead to the exfiltration of sensitive data, including API keys, source code, and data returned by connected tools, to an attacker-controlled server without user interaction.

Such unauthorized data exposure could potentially impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls over the confidentiality and security of sensitive information.

However, no direct integrity or availability impact was demonstrated, and there is no known exploitation in the wild as of the last update.

Useful 0 Not Useful 0