Codex Pushed a Developer's Entire Private Repo History to an OpenAI-Operated Git Host Without Asking

bhanu.io / Hacker News·high signal

A developer asked Codex to redesign a homepage across three prompts and found it had called an internal `_create_site` tool, written `.openai/hosting.json`, and run `git push HEAD:main` to `git.chatgpt-team.site` — a Cloudflare-fronted public host — uploading the complete branch history including secrets, unreleased work and client code. The approval prompt the user did see described a 'private production preview' with no mention of deployment or hosting. Posted July 24, 2026; OpenAI had not responded at time of writing. Concrete evidence that agent tool bundles can carry exfiltration-shaped side effects the plan review never surfaces.