OpenAI Codex macOS CVE-14898

OpenAI’s Codex desktop app for macOS contained a prompt-injection vulnerability that could leak sensitive data when the app rendered model responses containing remote Markdown images, according to public advisories published this week. The flaw is tracked as CVE-2026-14898 in the National Vulnerability Database and in a GitHub security advisory. Both advisories say an attacker who could place an indirect prompt injection in untrusted content processed by Codex could cause the model to construct a remote image URL containing sensitive data, which the app then fetched automatically. The affected product is OpenAI’s Codex desktop app, which OpenAI describes as a macOS and Windows application for parallel coding workflows with built-in Git support, automations and plugins. OpenAI’s product pages also say the app has expanded to include computer use, in-app browsing, memory and plugins, increasing the number of surfaces where untrusted external content can enter an agent workflow. ### How did the data leave the app without a click? (nvd.nist.gov) NVD says the macOS app “rendered remote images from Markdown in model responses” and automatically fetched attacker-controlled URLs during rendering. According to the advisory, that meant a malicious prompt embedded in a tool result or other untrusted source could induce Codex to place secrets inside the URL itself, sending them to an outside server as soon as the response was displayed. (developers.openai.com) GitHub’s advisory describes the same chain: indirect prompt injection in connected-tool output or another untrusted source, followed by model construction of a remote image URL containing sensitive data, followed by automatic retrieval by the app. The issue was specific to the macOS desktop app behavior described in the advisory text. ### What kinds of content could carry the malicious prompt? The NVD entry names “connected-tool result” and “another untrusted source” as examples of content that could carry the injection. (nvd.nist.gov) OpenAI’s own prompt-injection guidance defines prompt injection as a case where third-party content included in a model’s working context can mislead the model into following malicious instructions. OpenAI says prompt injections are an evolving security challenge for tools that browse, access external data or take actions on a user’s behalf. (github.com) OpenAI’s Codex documentation shows why that matters in this product. The app supports plugins, Git workflows, remote development features and computer-use capabilities that can read from or act on sources outside a single local file, according to OpenAI’s developer pages. ### Was this limited to model output, or did system permissions matter too? OpenAI’s computer-use documentation says the macOS app can be granted Screen Recording and Accessibility permissions so it can see and operate desktop applications. (nvd.nist.gov) The published CVE for 14898 is about automatic remote image fetching from rendered model output, not about those permissions directly, but the product documentation shows the app can hold broad workflow context and interact with external tools. (developers.openai.com) OpenAI has separately published safety material on designing agents to resist prompt injection and says product-level mitigations can include constrained actions, sandboxing and configurable network access. That guidance does not describe CVE-2026-14898 specifically, but it sets out the class of risk the Codex issue falls into. ### Where is the official record now? The National Vulnerability Database lists CVE-2026-14898 as published three days ago, and GitHub has a matching advisory under GHSA-gj6m-4qqg-3cw8. (developers.openai.com) OpenAI’s Codex app and security documentation remain publicly available on its developer site, which identifies the app as available on macOS and Windows and describes the features involved in agentic coding workflows. As of July 9, 2026, the public records I found confirm the vulnerability mechanics and the affected product, but I did not find an official OpenAI incident post in the searched sources stating exploitation in the wild or naming a separate disclosure researcher beyond the social post referenced in the prompt. (openai.com) (nvd.nist.gov)