Researchers Say Codex Flaw Put npm Releases at Risk

Depi says OpenAI fixed a security chain in Codex involving prompt injection, a sandbox escape, and publishing credentials. The disclosure confirms no malicious npm release reached users. The vulnerability could have exposed code repositories, but OpenAI has since patched it, mitigating immediate risks to developers.