Executive brief
The OpenAI Codex desktop application for macOS contained a flaw that allowed it to automatically load remote images embedded in chat responses. By using a technique called indirect prompt injection, an attacker could trick the AI into generating a response that includes a hidden image link containing the user's private data. Because the app loads these images automatically, sensitive information like API keys and source code could be sent to an attacker's server without the user ever clicking a link.
Technical details
This vulnerability is a sensitive information disclosure (CWE-200) resulting from the automatic rendering of remote Markdown images in the OpenAI Codex macOS desktop app. The root cause is the application's failure to restrict or require user interaction before fetching remote assets in model-generated responses. An attacker can exploit this via indirect prompt injection—placing malicious instructions in untrusted data sources (like web content or tool outputs) that Codex processes. The model is then coerced into appending sensitive session data, such as API keys or source code, as query parameters to a remote image URL. When the app renders the Markdown, it performs a GET request to the attacker's server, exfiltrating the data. The issue is addressed in version 26.527.31326.
Affected products
- OpenAI Codex desktop app for macOS < 26.527.31326
Timeline
- 2026-07-06: advisory: CVE-2026-14898 published by OpenAI