Preliminary research

How Command Injection in OpenAI Codex Led to GitHub Token Compromise

Tyler Jespersen and Phantom Labs · BeyondTrust

AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from March through September. Unranked, incomplete, not community-vetted, and subject to change.

Finds that a shell-active Git branch name reaches Codex cloud setup while GitHub credentials are available. Payloads shaped around Git ref restrictions can execute commands and steal the token, and repository-side branch creation makes the attack scalable across users of a shared repository.

Record

Researcher

Tyler Jespersen and Phantom Labs

Published by

BeyondTrust

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• ai-agent
• command-injection
• git
• token-theft
• supply-chain
• rce
• owasp-a03-2021
• owasp-a06-2021

This page is the archive's own catalogue record. The research is the work of Tyler Jespersen and Phantom Labs, first published at the original source. Preserved copies are kept so the citation survives its host.