Disclosed vulnerability
Turning ChatGPT Codex into a ZombAI agent via the Azure domain allowlist
AIR-2025-0075 AIR record · 2025-08-openai-codex-zombai
From the supporting source
With Internet access enabled, an attacker can use indirect prompt injection (for instance a description in a GitHub issue) to hijack Codex and run arbitrary code.embracethered.com
The record
Disclosed
2025-08-02
Vendor
OpenAI
Product
ChatGPT Codex
Risk domain
Access control and permissions › Privilege escalation
Also touches
Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted — Codex executed the injected commands and established C2
Attack surface
Coding agent
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection github issue
Impact type
Remote code execution, C2 control, Data exfiltration, Remote control, Code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Codex environments with internet access enabled
Capability abused
Defense & remediation
Recorded defense
Common Dependencies Allowlist restricting egress; it permits azure.com, so C2 can be hosted on an Azure VM
Guardrail kinds
Sandbox isolation, Permission scope
Guardrail outcome
Silent
Fix shipped
not fixed - OpenAI closed the 2025-06-10 report as Not Applicable
Taxonomy & references
Curator notes
Month of AI Bugs 2025. Also reported as: 'Turning ChatGPT Codex into a ZombAI agent via prompt injection'.
Supporting sources
Cite as
Enkrypt AI. "Turning ChatGPT Codex into a ZombAI agent via the Azure domain allowlist". AIR, AIR-2025-0075. https://agentincident.vercel.app/i/AIR-2025-0075/ (accessed 2026-10-19).