Codex's Two-Pass CI Job Lets an Agent Write the AGENTS.md That Instructs Its Own Next Run

Hackread·high signalXBlueskyLinkedInCopy link

The same Novee research found that the openai/codex repository itself ran two Codex passes inside a single CI job sharing one checkout, so a first pass manipulated by untrusted issue content could write an `AGENTS.md` file that the second pass then loads as its own project instructions. OpenAI assigned no CVE and deemed the behavior working-as-documented, which makes this a configuration problem every team must fix themselves rather than a patch to wait for. The concrete action: never share a checkout between two agent passes in one job, and treat any agent-writable instruction file as attacker-controlled input on the next invocation.