OpenAI Codex CLI/Desktop PowerShell Command-Safety Parser Bypass Leading to MCP Config Hijack
First seen Sep 4, 2026 · Updated Sep 4, 2026 · CVSS 8.8
OpenAI Codex CLI and Desktop failed to correctly parse PowerShell's stop-parsing token (--%), causing malicious commands to be misclassified as safe and auto-approved. An attacker who gets a user to open a poisoned repository can trick Codex into running an unapproved file-writing Git command that rewrites Codex's own configuration, ultimately allowing it to launch an attacker-controlled MCP server and execute code with the user's privileges.
Technical Analysis
The vulnerability lies in Codex's command-safety classifier, which evaluates shell commands for user-approval requirements before execution; it did not account for PowerShell's --% stop-parsing token semantics, letting attacker-crafted Git commands embedded in repository instructions (e.g., README, hooks, or agent-following files) bypass the safety check and execute without user consent. The entry point is a malicious repository that Codex opens and whose embedded instructions it follows autonomously (an agentic prompt-injection-like vector via repository content). If the write succeeds against filesystem sandbox restrictions, it can overwrite Codex's config file to point at an attacker-controlled MCP server; when Codex subsequently loads this config, it starts the rogue MCP server, granting the attacker code execution under the user's OS privileges and full access to files reachable by that account. This crosses the tool-boundary from a scoped Git file-write into arbitrary MCP-server-mediated code execution, and the default macOS/Linux sandbox is the last line of defense, meaning it is not present or is misconfigured/disabled cases where full compromise occurs.
Affected Systems
OpenAI Codex CLI, OpenAI Codex Desktop; protocols: MCP
Detection Signatures
- Git commands containing PowerShell stop-parsing token (--%) embedded in repository files, hooks, or Codex-readable instructions
- Unexpected modifications to Codex configuration files (e.g., MCP server URLs/paths) outside of user-initiated changes
- Codex launching MCP server processes not previously configured by the user
- File-writing Git operations executed without a corresponding user-approval prompt/log entry
- pwsh invocation from Codex sandboxed sessions on macOS/Linux where not expected
Remediation Steps
- 1
Update Codex CLI/Desktop
Apply the vendor patch that fixes the command-safety parser's handling of PowerShell's stop-parsing token (--%) so unsafe commands are correctly flagged for approval.
- 2
Audit Codex configuration integrity
Verify Codex configuration files, especially MCP server entries, have not been tampered with; restore from known-good backups if unauthorized changes are found.
- 3
Enforce filesystem sandboxing
Ensure the default filesystem sandbox is enabled and correctly scoped on all platforms, since it is the primary control preventing out-of-bounds writes even when approval is bypassed.
- 4
Restrict untrusted repository use
Avoid opening or auto-running agent instructions from untrusted or unvetted repositories with Codex; review repository content before allowing agentic execution.
- 5
Limit PowerShell Core availability
On macOS/Linux, restrict or monitor installation and invocation of PowerShell Core (pwsh) in environments where Codex operates, since it is required for this exploit path there.
- 6
Monitor MCP server launches
Log and alert on any newly configured or unexpected MCP server processes started by Codex to catch post-exploitation activity early.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.