Codex pushed a developer's private repo to OpenAI's servers

Codex pushed a developer's full repository, secrets and unreleased client work included, to an OpenAI-operated git host after three homepage redesign prompts, according to the developer's account.

That's the full branch history, current files and all, sent to a server the developer never agreed to use. Whatever guardrail Codex has for exfiltration risk didn't catch this. The approval prompt it showed described a private production preview and said nothing about deployment or hosting.

Under that prompt, the agent called an internal _create_site tool and wrote a .openai/hosting.json file into the repo. Then it ran git push HEAD:main to git.chatgpt-team.site, a host sitting behind Cloudflare. None of those three steps showed up in what the developer clicked approve on.

OpenAI hadn't responded to the report as of this writing.

Codex's approval prompt described what the tool does, not what it did. That's the actual failure: a plan review that surfaces intent instead of the network calls behind it. Any coding agent with shell and git access has the same gap. What it needs is an approval layer that shows the literal command, not a label for what the command is supposed to accomplish.