Codex created a GitHub repository as public without explicit visibility instruction
Summary
Codex created a GitHub repository as public without any explicit user instruction to make it public.
The expected safe default for autonomous repository creation should be private unless the user explicitly requests public visibility.
What Happened
In my session, I asked Codex to proceed with creating the remote repository needed to unblock a control-plane task.
I did not specify repository visibility.
Codex created:
ruggeropaolobasile/master-control- visibility:
public
I immediately noticed it, flagged it as a security problem, and the repository was then changed to private.
Why This Is Problematic
This is not a classic security vulnerability or privilege-escalation bug.
It is an unsafe autonomous default:
- the model/tool had permission to create the repository
- the user did not ask for
public - the safer default should have been
private - creating a public repository can unintentionally expose source code, artifacts, internal docs, or operational metadata
Expected Behavior
When Codex creates a GitHub repository and the user has not explicitly requested a visibility level:
- default to
private - or require explicit confirmation before creating a
publicrepository
Actual Behavior
Codex created the repository as public without explicit instruction to do so.
Suggested Fix
One of these should be enforced:
- default all autonomous GitHub repo creation to
private - require explicit confirmation for
public - treat missing visibility as a safety-sensitive ambiguity and stop to ask
Additional Context
- repository was later corrected to
private - this appears more like a product / safety behavior issue than a bug-bounty vulnerability
- I am reporting it because the default can cause accidental exposure in real workflows
Showing cached comments. Read the full discussion on GitHub ↗
4 Comments
/attempt
/attempt
This behavior sounds reasonable to me. If you want a GitHub repository to be created as private, you can specify that.
I understand the literal interpretation, but I think the safety concern is about autonomous defaults rather than syntax.
A repository visibility choice is not a neutral detail: creating a public repo can immediately expose code, docs, metadata, or work-in-progress artifacts. In that context, “unspecified” is materially different from “user asked for public”.
My point is not that Codex lacked permission to create the repo. It is that, when acting autonomously and visibility is omitted, the safer product behavior would be one of:
That would align the action with a least-exposure default for external side effects.
Even if the current behavior is considered reasonable from a literal API perspective, I still believe it is a weak default for an autonomous agent operating on behalf of users.