Skip to main content
OpenAI

October 30, 2026

Security

CVE-2026-14898

In affected versions of Codex Desktop for macOS, an attacker could put instructions in content that Codex processed. Those instructions could make the model include session data in an image URL. The app sent the data to the attacker's server when it loaded the image.

Affected products & versions

VendorProductPlatformAffected versions
OpenAICodex Desktop (application)macOSBefore 26.527.31326

Impact

An attacker could get API keys, source code, or data from connected tools if the Codex session had access to them. The reported attack did not show that the attacker could change data or interrupt service.

Conditions

The app had to load remote images from Markdown. Codex had to process content that contained the attacker's instructions, such as a result from a connected tool.

Known exploitation

No known abuse in the wild.

Mitigations

  • Update Codex Desktop for macOS to version 26.527.31326 or a subsequent version.
  • If you cannot update, do not use Codex Desktop to process untrusted content or data from connected tools.

Vulnerability description

The attack used indirect prompt injection. If the model obeyed instructions in untrusted content, it could add a remote Markdown image to its response. The image URL could contain sensitive data from the session.

When the app displayed the response, it automatically requested the image from the attacker's server. The server received the data in the URL. The user did not have to click the image.

Problem type

CWE-200⁠(opens in a new window) — Exposure of Sensitive Information to an Unauthorized Actor.

Credits

  • wuzzi23 (original report)
  • Itay Ravia of Cato Networks (independent report)

References

Author

OpenAI

Publication and revision history

DateChange
July 6, 2026Original publication of the CVE record⁠(opens in a new window).
October 30, 2026Publication on openai.com.