--- title: A Semicolon in a Branch Name Was All It Took to Steal an... description: A critical command injection flaw in OpenAI's Codex, disclosed by BeyondTrust's Phantom Labs in March, let attackers steal GitHub OAuth tokens simply by... canonical: https://daily.dev/posts/a-semicolon-in-a-branch-name-was-all-it-took-to-steal-an-ai-agent-s-github-token-oct5s212e twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A Semicolon in a Branch Name Was All It Took to Steal an AI Agent’s GitHub Token | daily.dev og:description: A critical command injection flaw in OpenAI's Codex, disclosed by BeyondTrust's Phantom Labs in March, let attackers steal GitHub OAuth tokens simply by... og:url: https://daily.dev/posts/a-semicolon-in-a-branch-name-was-all-it-took-to-steal-an-ai-agent-s-github-token-oct5s212e og:image: https://api.daily.dev/og/posts/OCt5S212e.png og:image:alt: A Semicolon in a Branch Name Was All It Took to Steal an AI Agent’s GitHub Token og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A Semicolon in a Branch Name Was All It Took to Steal an AI Agent’s GitHub Token **[DevOps.com](https://daily.dev/sources/devops)** · 4 min read · 1 upvotes · 0 comments ## Summary A critical command injection flaw in OpenAI's Codex, disclosed by BeyondTrust's Phantom Labs in March, let attackers steal GitHub OAuth tokens simply by setting a branch name with shell metacharacters like semicolons. The unsanitized branch name flowed into a shell command, letting an injected command dump the token to a file that the agent then read back in its own output. The bug affected every Codex surface (web, CLI, SDK, IDE extension) and took OpenAI about six weeks to fix. The piece argues the real risk is over-provisioned agent credentials: Teleport's 2026 report found organizations over-provisioning AI systems see 4.5x more incidents, 70% grant agents more access than an equivalent human, and 67% still use static credentials. Gravitee's 2026 report found 82% of executives are confident in their agent security policies while only 47.1% of agents are actually monitored. Recommendations include scoping credentials to the task, treating all free-text agent inputs as untrusted, using short-lived single-use credentials, and demanding concrete visibility into what an agent's credentials can actually do. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the OpenAI Codex command injection vulnerability let attackers steal GitHub tokens? Codex passed the target branch name into a shell command without sanitizing it, so characters like semicolons, ampersands, pipes, and backticks were interpreted literally by Bash. An attacker could set the branch to something like 'main; command', terminating the intended git command and injecting one that wrote the output of 'git remote get-url origin' (containing the GitHub OAuth token in cleartext) to a file, which the agent then read back on request. _Teams wiring up coding agents track disclosures like this one to keep credential scoping decisions current on daily.dev._ ### Which parts of OpenAI Codex were affected by the branch-name command injection flaw disclosed by BeyondTrust's Phantom Labs? The vulnerability hit every surface Codex ships, including the ChatGPT web interface, the CLI, the SDK, and the IDE extension. Researchers confirmed it could be automated to compromise multiple users sharing a single repository, not just an individual target. OpenAI spent roughly six weeks on iterative hardening before classifying it Critical and clearing it for public disclosure. _Developers auditing their AI toolchain surface area can follow security writeups like this via daily.dev._ ### Why do organizations that over-provision AI agent credentials see more security incidents? Teleport's 2026 State of AI in Enterprise Infrastructure Security report, based on interviews with 205 CISOs and security architects, found organizations that over-provision AI systems experience 4.5 times more security incidents than those enforcing least privilege. Separately, 70% admit granting AI agents higher access than a human doing the same task would get, and 67% still rely on static rather than short-lived credentials. _Security architects weighing least-privilege policies for AI agents can keep tabs on reports like this through daily.dev._ ## Similar posts on daily.dev - [Agentic AI Security Comes Down to Access, Not the Trick](https://daily.dev/posts/agentic-ai-security-comes-down-to-access-not-the-trick-q9sdq1e4s) · GitGuardian · 0 upvotes · 0 comments - [GitLost: GitHub's AI agent leaks private repos when asked](https://daily.dev/posts/gitlost-github-s-ai-agent-leaks-private-repos-when-asked-qlzfcubqe) · The Next Web · 2 upvotes · 1 comments - [Coding Agent Horror Stories: The 29 Million Secret Problem](https://daily.dev/posts/coding-agent-horror-stories-the-29-million-secret-problem-3aivjwf10) · Docker · 28 upvotes · 5 comments - [A GitHub Issue Title Compromised 4,000 Developer Machines](https://daily.dev/posts/a-github-issue-title-compromised-4-000-developer-machines-e5lzhfwln) · Hacker News · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#openai-codex](https://daily.dev/tags/openai-codex) [View this post on daily.dev](https://daily.dev/posts/a-semicolon-in-a-branch-name-was-all-it-took-to-steal-an-ai-agent-s-github-token-oct5s212e) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A Semicolon in a Branch Name Was All It Took to Steal an AI Agent’s GitHub Token","url":"https://daily.dev/posts/a-semicolon-in-a-branch-name-was-all-it-took-to-steal-an-ai-agent-s-github-token-oct5s212e","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a-semicolon-in-a-branch-name-was-all-it-took-to-steal-an-ai-agent-s-github-token-oct5s212e"},"datePublished":"2026-09-30T19:41:41.363Z","dateModified":"2026-09-30T19:42:08.899Z","description":"A critical command injection flaw in OpenAI's Codex, disclosed by BeyondTrust's Phantom Labs in March, let attackers steal GitHub OAuth tokens simply by...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/817a3b73a3775e872796d8244b3ce1f0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/817a3b73a3775e872796d8244b3ce1f0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"DevOps.com","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"DevOps.com","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/db8f2265cff0416c878c6e7e92bb8715","url":"https://daily.dev/sources/devops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a-semicolon-in-a-branch-name-was-all-it-took-to-steal-an-ai-agent-s-github-token-oct5s212e","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,openai-codex","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DevOps.com","item":"https://daily.dev/sources/devops"},{"@type":"ListItem","position":3,"name":"A Semicolon in a Branch Name Was All It Took to Steal an AI Agent’s GitHub Token"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/a-semicolon-in-a-branch-name-was-all-it-took-to-steal-an-ai-agent-s-github-token-oct5s212e#faq","mainEntity":[{"@type":"Question","name":"How did the OpenAI Codex command injection vulnerability let attackers steal GitHub tokens?","acceptedAnswer":{"@type":"Answer","text":"Codex passed the target branch name into a shell command without sanitizing it, so characters like semicolons, ampersands, pipes, and backticks were interpreted literally by Bash. An attacker could set the branch to something like 'main; command', terminating the intended git command and injecting one that wrote the output of 'git remote get-url origin' (containing the GitHub OAuth token in cleartext) to a file, which the agent then read back on request. Teams wiring up coding agents track disclosures like this one to keep credential scoping decisions current on daily.dev."}},{"@type":"Question","name":"Which parts of OpenAI Codex were affected by the branch-name command injection flaw disclosed by BeyondTrust's Phantom Labs?","acceptedAnswer":{"@type":"Answer","text":"The vulnerability hit every surface Codex ships, including the ChatGPT web interface, the CLI, the SDK, and the IDE extension. Researchers confirmed it could be automated to compromise multiple users sharing a single repository, not just an individual target. OpenAI spent roughly six weeks on iterative hardening before classifying it Critical and clearing it for public disclosure. Developers auditing their AI toolchain surface area can follow security writeups like this via daily.dev."}},{"@type":"Question","name":"Why do organizations that over-provision AI agent credentials see more security incidents?","acceptedAnswer":{"@type":"Answer","text":"Teleport's 2026 State of AI in Enterprise Infrastructure Security report, based on interviews with 205 CISOs and security architects, found organizations that over-provision AI systems experience 4.5 times more security incidents than those enforcing least privilege. Separately, 70% admit granting AI agents higher access than a human doing the same task would get, and 67% still rely on static rather than short-lived credentials. Security architects weighing least-privilege policies for AI agents can keep tabs on reports like this through daily.dev."}}]} ```