← Back to the boardNews
Backdooring the next release of Codex through GitHub Action pipeline exploit chaining
Why it’s here: A detailed cybersecurity vulnerability report on prompt injection and CI/CD supply-chain compromise of OpenAI's Codex npm publishing pipeline, bearing on AI and cybersecurity policy and the supply-chain threat landscape affecting AI firms active in DC.
Trace across the boardItem
4d agoDepiBackdooring the next release of Codex through GitHub Action pipeline exploit chainingDepi researchers disclose a prompt-injection-to-supply-chain exploit chain in OpenAI Codex's GitHub Action workflows, claiming they could have poisoned the publishing pipeline for the @openai/codex npm package.1 outletCyber1 linked
Connected
1 links- NewsGitHub Actions Security Pt 2: AI-Powered Actions Analysis | Wiz BlogBoth involve OpenAI, GitHub Actions, @openai/codex
About
- OpenAI
- GitHub Actions