10:24
2026-10-03
dev.to
ai-agents
A semicolon in a Codex branch name leaked its GitHub token. Scope decided the damage
BeyondTrust's Phantom Labs disclosed a critical command-injection flaw in OpenAI's Codex in March, in which an unsanitized branch name containing a semicolon allowed shell metacharacters to execute an…