DANGEROUS: Codex try to execute JavaScript obfuscated code - Malware when i ask for check what it is
Resolved 💬 4 comments Opened Mar 24, 2026 by khanhnhat1660407 Closed Mar 24, 2026
💡 Likely answer: A maintainer (github-actions[bot], contributor)
responded on this thread — see the highlighted reply below.
What version of Codex CLI is running?
codex-cli 0.116.0
What subscription do you have?
Plus
Which model were you using?
gpt-5.3-codex
What platform is your computer?
Darwin 25.3.0 arm64 arm
What terminal emulator and version are you using (if applicable)?
Terminal.app
What issue are you seeing?
I asked the Codex: check <path>/babel.config.js, there is JavaScript obfuscated code, what is it?
And it executed the obfuscated code. In that situation, there's a 90% chance it was malware, but it executed the code without asking my permission.
What steps can reproduce the bug?
Uploaded thread: 019d1f89-9235-7340-8b33-c4257a71cdbe
What is the expected behavior?
Analyze the code before execution. Determine if the code is potentially malware and suggest a course of action.
Additional information
_No response_
4 Comments
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
More information:
I was active codex by ran: codex without any options
This is a serious gap. The fundamental problem is that "analyze this code" was interpreted as "run this code" — and for obfuscated JavaScript, running it is the worst possible analysis strategy.
We see a related pattern in AI-assisted development that is worth flagging: agents routinely execute code as part of their "understanding" workflow without distinguishing between safe-to-run and unsafe-to-run artifacts. An obfuscated file is the obvious dangerous case, but the same behavior applies to:
The sandbox helps for some of these, but as this issue shows, the decision to execute should happen before the sandbox — at the intent classification level. "Check what this is" should route to static analysis, not eval.
A pre-flight scan that classifies file content before the agent touches it would catch this. We have been building exactly this kind of deterministic check layer — it runs before the agent acts, not after:
npx @opencodereview/cli scan . --sla L1It flags obfuscated code, suspicious dependency patterns, and other artifacts that should be analyzed statically rather than executed.
Thanks for the bug report. We'll share the feedback with the team responsible for training our codex models. If you see other model behavior that you'd like to report, please use the
/feedbackcommand. That will provide us with additional details including logs and conversation text.