gpt-5.3-codex injected obfuscated malware payload into source files during session

Open 💬 2 comments Opened May 7, 2026 by SollerMontek

What version of the Codex App are you using (From “About Codex” dialog)?

codex-cli 0.128.0-alpha.1

What subscription do you have?

Chatgpt pro

What platform is your computer?

OS: Linux (WSL2 - 6.6.87.2-microsoft-standard-WSL2)

What issue are you seeing?

During a Codex session on May 4th, 2026, the model (gpt-5.3-codex, CLI version 0.128.0-alpha.1) injected an obfuscated malicious JavaScript payload into source files across multiple projects. The payload was identical in all affected files and executed arbitrary code at runtime by hijacking Node.js globals.

What steps can reproduce the bug?

Exact reproduction steps are unknown, but the session context was:

Codex was working on a Node.js/Express project (Montek-BI-App---middleware)
trust_level was set to "trusted" for the project in ~/.codex/config.toml
Codex read adminRoutes.js via sed during the session
The file was written back with the payload appended

What is the expected behavior?

<html>
<body>
<h2 style="color: rgb(191, 191, 191); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(25, 26, 27); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Affected Files</h2><p style="white-space: pre-wrap; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(25, 26, 27); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Three files across two separate projects were found with the identical payload appended after otherwise legitimate code:</p>
File | Project
-- | --
eslint.config.js | montek_admin/front/Montek_Admin
postcss.config.mjs | montek_projects/montek_proveedores/Montek-Portal-Proveedores
api_node/src/routes/adminRoutes.js | montek_projects/montek_app_middleware/Montek-BI-App---middleware

<p style="white-space: pre-wrap; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(25, 26, 27); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">The session log confirms Codex read <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">adminRoutes.js</code> during the session. The file was clean before the session and was found compromised afterward.</p>
</body>
</html>

Additional information

The injection was discovered during a routine code review. A scan using grep for the signature global['!'] and _$_1e42 across all projects found 3 infected files. The Codex session log at ~/.codex/sessions/2026/05/04/rollout-2026-05-04T09-10-57-019df38a-df21-79b1-98b5-fcc4aa388ffd.jsonl was the only session log containing the payload string, confirming it originated from that session.

All three files were manually restored to their clean versions
All projects were scanned for additional infections (none found beyond the three files)
npm audit was run across all 8 projects in the workspace

Investigate whether gpt-5.3-codex model versions have a known issue with payload injection during file writes
Consider adding file diff validation before Codex writes files in trusted mode
Notify users of 0.128.0-alpha.1 who may be affected

Codex CLI version: 0.128.0-alpha.1
Model: gpt-5.3-codex
Source: VSCode extension (codex_vscode)
Session ID: 019df38a-df21-79b1-98b5-fcc4aa388ffd
Session timestamp: 2026-05-04T15:10:57.871Z
Working directory during session: /home/sollermontek/montek_projects/montek_app_middleware/Montek-BI-App---middleware
OS: Linux (WSL2 - 6.6.87.2-microsoft-standard-WSL2)

View original on GitHub ↗

This issue has 2 comments on GitHub. Read the full discussion on GitHub ↗