--- title: Medium | daily.dev description: A comprehensive security analysis of the Codex memory engine (used by the VS Code ChatGPT extension) demonstrating a critical attack chain combining AI agent... canonical: https://daily.dev/posts/medium-2fpzdrwe3 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Medium | daily.dev og:description: A comprehensive security analysis of the Codex memory engine (used by the VS Code ChatGPT extension) demonstrating a critical attack chain combining AI agent... og:url: https://daily.dev/posts/medium-2fpzdrwe3 og:image: https://api.daily.dev/og/posts/2fpzdrWE3.png og:image:alt: Medium og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Medium **[Medium](https://daily.dev/sources/medium_js)** · 22 min read · 0 upvotes · 0 comments ## Summary A comprehensive security analysis of the Codex memory engine (used by the VS Code ChatGPT extension) demonstrating a critical attack chain combining AI agent memory poisoning with an apply_patch TOCTOU vulnerability. The paper details how an attacker with browser Developer Tools access can manipulate every layer of client-side memory (atoms, fragments, blocks, conversation state) to forge conversation history, override system prompts, and inject commands. Combined with a TOCTOU flaw in the apply_patch tool used by GitHub Copilot, VS Code Copilot Chat, and OpenClaw — where the confirmation mechanism only validates source paths but not Move-to destinations — this creates a full RCE chain by overwriting sensitive files like .git/config. The paper also demonstrates that client-side cryptographic integrity checks are ineffective via the 'apply latcher' technique, and provides a CVE inventory (2025–2026) plus a mitigation framework centered on server-side state authority, path canonicalization, and ephemeral client caches. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the apply_patch TOCTOU vulnerability affecting GitHub Copilot and VS Code Copilot Chat? It is a time-of-check to time-of-use flaw where the patch confirmation dialog (prepareInvocation) only parses and displays *** Update File and *** Add File directives, ignoring a *** Move to directive. When invoke runs, it honors the unchecked Move to path, letting an attacker hide a rename to a sensitive file like .git/config behind an approved-looking change to something innocuous like README.md. _Anyone hardening AI coding assistant workflows can track disclosures like this through daily.dev to catch similar patch-confirmation gaps early._ ### Why do client-side cryptographic integrity checks fail to protect AI agent memory stored in localStorage? Because verification logic runs entirely in the browser, an attacker with DevTools access can extract any function's source via Function.prototype.toString, patch Function.prototype.apply to intercept and force-pass calls like verifyHmac, or redefine functions with Object.defineProperty, bypassing HMAC or similar checks regardless of how strong the cryptography is. _Developers weighing client versus server trust boundaries for agent state can follow this reasoning via daily.dev before designing their own safeguards._ ### What mitigation is recommended to stop AI agent memory poisoning attacks via browser localStorage? Move all state authority to the server: the client sends intents plus a version number, and the server validates authorization and version match before applying and returning the authoritative state. Client-side caches should be ephemeral, read-only, and cleared on session end, since any client-side check, cryptographic or not, can be patched at runtime by an attacker with DevTools access. _Teams designing persistence for AI agents can use daily.dev to compare server-authority patterns against client-trust pitfalls._ ## Similar posts on daily.dev - [Breaking Opus 4.7 with ChatGPT \(Hacking Claude's Memory\) · Embrace The Red](https://daily.dev/posts/breaking-opus-4-7-with-chatgpt-hacking-claude-s-memory-embrace-the-red-i3pdz3zfb) · Embrace The Red · 1 upvotes · 0 comments - [How AI Coding Tools Crushed the Endpoint Security Fortress](https://daily.dev/posts/how-ai-coding-tools-crushed-the-endpoint-security-fortress-oivfawpcr) · Dark Reading · 1 upvotes · 0 comments - [Security Flaws in Anthropic’s Claude Code Risk Stolen Data, System Takeover](https://daily.dev/posts/security-flaws-in-anthropic-s-claude-code-risk-stolen-data-system-takeover-j81sidgwk) · DevOps.com · 1 upvotes · 0 comments --- Tags: [#github](https://daily.dev/tags/github), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/medium-2fpzdrwe3) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Medium","url":"https://daily.dev/posts/medium-2fpzdrwe3","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/medium-2fpzdrwe3"},"datePublished":"2026-07-24T19:33:56.185Z","dateModified":"2026-09-13T20:05:45.778Z","description":"A comprehensive security analysis of the Codex memory engine (used by the VS Code ChatGPT extension) demonstrating a critical attack chain combining AI agent...","image":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","thumbnailUrl":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/medium-2fpzdrwe3","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"github,prompt-injection","timeRequired":"PT22M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Medium"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/medium-2fpzdrwe3#faq","mainEntity":[{"@type":"Question","name":"What is the apply_patch TOCTOU vulnerability affecting GitHub Copilot and VS Code Copilot Chat?","acceptedAnswer":{"@type":"Answer","text":"It is a time-of-check to time-of-use flaw where the patch confirmation dialog (prepareInvocation) only parses and displays *** Update File and *** Add File directives, ignoring a *** Move to directive. When invoke runs, it honors the unchecked Move to path, letting an attacker hide a rename to a sensitive file like .git/config behind an approved-looking change to something innocuous like README.md. Anyone hardening AI coding assistant workflows can track disclosures like this through daily.dev to catch similar patch-confirmation gaps early."}},{"@type":"Question","name":"Why do client-side cryptographic integrity checks fail to protect AI agent memory stored in localStorage?","acceptedAnswer":{"@type":"Answer","text":"Because verification logic runs entirely in the browser, an attacker with DevTools access can extract any function's source via Function.prototype.toString, patch Function.prototype.apply to intercept and force-pass calls like verifyHmac, or redefine functions with Object.defineProperty, bypassing HMAC or similar checks regardless of how strong the cryptography is. Developers weighing client versus server trust boundaries for agent state can follow this reasoning via daily.dev before designing their own safeguards."}},{"@type":"Question","name":"What mitigation is recommended to stop AI agent memory poisoning attacks via browser localStorage?","acceptedAnswer":{"@type":"Answer","text":"Move all state authority to the server: the client sends intents plus a version number, and the server validates authorization and version match before applying and returning the authoritative state. Client-side caches should be ephemeral, read-only, and cleared on session end, since any client-side check, cryptographic or not, can be patched at runtime by an attacker with DevTools access. Teams designing persistence for AI agents can use daily.dev to compare server-authority patterns against client-trust pitfalls."}}]} ```