OpenAI Codex Markdown Image Rendering Data Exfiltration via Indirect Prompt Injection

Technical Analysis

The entry point is untrusted content ingested by Codex from connected tools or other external sources, which can contain hidden instructions that hijack the model's output generation. Once injected, the attacker directs the model to encode sensitive session data (secrets, code snippets, tool results) into a URL parameter of a Markdown image tag. Because Codex auto-renders remote images without user confirmation, the app performs an outbound HTTP request to the attacker's server, which logs the URL and thus the embedded data — completing exfiltration purely through rendering behavior. This crosses the boundary from model output to network egress without any human-in-the-loop gate, turning a display feature into a covert channel for data leakage from the agent's context.

Affected Systems

OpenAI Codex desktop app (macOS)

Detection Signatures

• Outbound HTTP/HTTPS requests to unfamiliar or newly-registered domains immediately following model response rendering
• Markdown image URLs containing unusually long query strings, base64-like data, or high-entropy parameters
• Tool or connector outputs containing embedded natural-language instructions directing image/link generation
• Network egress from the Codex process correlated with rendering of assistant-generated Markdown rather than explicit user action
• Repeated or templated URL patterns with variable data segments appended by the model

Remediation Steps

1. 1

   Disable auto-fetching of remote images

   Do not automatically render remote images embedded in model-generated Markdown; require explicit user approval before any network fetch triggered by assistant output.

2. 2

   Sanitize and restrict Markdown rendering

   Strip or neutralize image/link constructs that include dynamic, model-controlled URL parameters, or route them through a proxy that redacts query strings before fetch.

3. 3

   Apply egress allowlisting

   Restrict outbound requests from the agent client to a vetted domain allowlist, blocking arbitrary attacker-controlled endpoints.

4. 4

   Treat tool/connector output as untrusted

   Apply the same injection-resistant handling to connected-tool results as to any other untrusted external input, including content filtering before it reaches the model context.

5. 5

   Patch to fixed version

   Update Codex desktop app to the version that addresses this CVE and removes automatic remote image fetching from unreviewed model output.