OpenAI Codex CLI

CERT Intrinsec maps where autonomous coding agents leave evidence on disk; the same session databases and token files an investigator needs are a credential-collection target

Autonomous coding agents now run shells, install helpers and reach networks on developer and build endpoints, and this pipeline has already covered a case of one standing up a reverse tunnel and installing persistence on a real macOS developer machine. CERT Intrinsec's contribution is the responder-side counterpart: where these tools actually leave evidence (CERT Intrinsec, 2026-07-27, CERT Intrinsec, 2026-07-31).

For OpenCode, an open-source agent shipped as a CLI, desktop application and IDE extension, configuration lives in a per-user opencode directory whose opencode.json records how the agent was set up. The artefact that matters most is a SQLite database, Intrinsec calls opencode.db "the most valuable artifact", "a SQLite database storing sessions, messages, projects, workspaces, etc." Its message table distinguishes model responses from user prompts by whether a timing field is present alongside the text, so an investigator can reconstruct both halves of a conversation and bound each response in time. A separate file in the same tree holds authentication material: "This file contains authentication information such as API keys."

For OpenAI's Codex CLI the shape is the same with different names. Everything sits under a per-user .codex directory; auth.json carries authentication information including API keys and access tokens; history.jsonl carries the list of user prompts; and per-session rollout logs record the session itself, including token-usage events that report input, cached-input, output and reasoning-token counts for the session and for the most recent response, plus the model's context window. That last detail is more useful than it first appears, it lets a responder estimate how much material an agent session actually processed without having to reconstruct the content.

The dual reading is the point. For incident response this is a map of where to look when a coding agent is implicated in an intrusion, and the prompt history is unusually valuable evidence because it records operator intent directly rather than by inference. For threat modelling it is an inventory: an attacker who reaches a developer workstation or a CI runner with any code execution finds provider credentials in cleartext JSON at a predictable per-user path, together with a transcript of what the organisation has been building. Neither file requires privilege escalation to read if the attacker already has the user's context.

'Friendly Fire': prompt injection hijacks AI coding agents' defensive auto-review into remote code execution

AI Now Institute researchers Boyan Milanov and Heidy Khlaaf published a proof-of-concept, "Friendly Fire," that achieves remote code execution against Anthropic's Claude Code CLI (auto-mode, with Sonnet 4.6, Sonnet 5 or Opus 4.8) and OpenAI's Codex CLI (auto-review, with GPT-5.5) when either is used for its advertised defensive purpose, reviewing the security of an untrusted open-source or third-party library (AI Now Institute, 2026-07-08). The attack needs only an out-of-the-box configuration: no custom hooks, skills, plugins, MCP servers, or machine-configuration files as an injection vector. The chain is two layers of prompt injection carried entirely inside the reviewed repository's own files. The first layer makes a malicious binary look safe: alongside the binary (code_policies) the attacker ships a decoy Go source file (code_policies.go) implementing a legitimate-looking static checker, and embeds matching string constants in the binary so the agent's own disassembly-inspection step associates the two and clears it. The second layer, placed in README.md (deliberately, because README is not an enforceable machine-config file and needs no user approval) references a bundled security.sh "security checker" in innocuous language, leading the agent to run the script, which launches the binary (AI Now Institute, 2026-07-08; Infosecurity Magazine, 2026-07-10).

The researchers demonstrated the technique against a modified copy of the geopy Python library and report it transfers to other libraries and to Codex without modification, mapping it onto two realistic threat models: malicious library maintainers embedding instructions in their own code, and supply-chain compromise of upstream packages (they cite recent GitHub-repo-poisoning and PyTorch Lightning incidents), the latter especially dangerous where CI/CD auto-updates dependencies and then hands them to a defensive agent to review. They explicitly reject sandboxing as a sufficient mitigation, arguing an in-sandbox RCE can be used to attempt escape and citing sandbox-escape CVEs against Claude Code itself.

Builds on: Mozilla 0DIN: a "clean" GitHub repo coerces AI coding agents into a reverse shell via… · Wiz "GhostApproval": malicious repos escape the workspace sandbox of six AI coding assistants…