Codex reccomended a compromised github action

What version of Codex is running?

Latest

What subscription do you have?

Team and Pro

Which model were you using?

gpt-5.1-codex-max

What platform is your computer?

Mac

What issue are you seeing?

It reccomended a compromised github action:

`` 20 + - name: Detect optimizer SDK changes
21 + id: changed-optimizer
22 + uses: tj-actions/changed-files@v44
23 + with:
24 + files: |
25 + sdks/opik_optimizer/**/*.py
26 + sdks/opik_optimizer/pyproject.toml
27 + sdks/opik_optimizer/setup.py``

What steps can reproduce the bug?

Uploaded thread: 019aa736-1a6b-7c60-9502-21f91c297eaf

What is the expected behavior?

_No response_

Additional information

_No response_