Codex Hardening Confirms It: Assume the Repository Is Hostile

OpenAI’s July hardening of Codex is worth reading for what it patches rather than what it adds. Among the changes: command-safety work that prevents repository-provided Git helpers and hooks from executing, blocking of PowerShell parser execution on non-Windows hosts, rejection of browser-origin exec-server websocket handshakes, native exec-server sandboxing with network-proxy enforcement, and improved forced-rm detection. The first item is the significant one. If a repository’s own Git hooks can run inside the agent sandbox, then cloning a malicious repo executes attacker code with your agent’s privileges — which means the operative threat model is now that the codebase you pointed the agent at is hostile. That is a real, exploitable class of attack against every coding agent, not just this one. If you run agents against untrusted repositories, check whether your tooling disables repo-provided hooks. Most do not, by default.