OpenAI Codex CLI

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz P1: Critical (published engagement range tops at $6,500; the $100,000 on the brief is a discretionary max-reward hint, not a band) │ $500 - $1,500 │ $625 - $1,875 P2: High │ $250 - $500 │ $313 - $625 P3: Medium │ $100 - $250 │ $125 - $313 P4: Low │ $50 - $100 │ $63 - $125 Submit a vulnerability CVE history 2 Last 12 months 2 Lifetime Code execution 40 % Access control 25 % Injection 20 % Info disclosure 10 % Latest advisories Loading the feed Overview Codex CLI is OpenAI's terminal coding agent, one of the two or three most widely installed tools of its kind at roughly 102,000 GitHub stars, and it runs with filesystem and shell access on developer machines and inside CI; openai/openai-agents-python and its JS/TS counterpart are the reference agent-orchestration SDKs for OpenAI models. The exploitation model is not a remote attacker hitting a web server: it is a malicious repository or a malicious MCP server reaching a tool that already holds the developer's credentials and write access, which is precisely what the two published CVEs describe: CVE-2025-59532, a sandbox bypass in path configuration logic, and CVE-2025-61260, code execution through a malicious Model Context Protocol server. OpenAI pays through Bugcrowd on the healthiest program in this niche by payout record: 538 rewarded vulnerabilities, an average payout of $1,466.75 and validation inside five days. The published engagement range runs $50 to $6,500, with P1 at $500 to $1,500 down to P4 at $50 to $100; the $100,000 that appears on the brief is Bugcrowd's discretionary max-reward hint rather than a band you can plan against. One evidence caveat belongs on the same page as the numbers: the proof that this repository is a paying target is openai/codex 's own SECURITY.md, not a quoted scope row, because Bugcrowd's asset table needs an authenticated session. sorona.xyz adds 1.25× on top of whatever OpenAI awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope openai/codex 's own security policy is the declaration: OpenAI's security program runs through Bugcrowd and asks that validated vulnerabilities be reported there, which puts the Apache-2.0 Codex CLI repository on the paid program The Codex CLI as a whole: session and configuration handling, the terminal interface, and the tool-execution layer that runs shell commands and applies patches The sandbox and its path-configuration logic, the boundary between the agent and the developer's real filesystem The approval-prompt and network-control layers, which stand between a model's suggested command and that command actually running Codex's MCP client and its server transports, where an attacker-controlled server is the input Credential, token and session storage, including the login flow the CLI authenticates through openai/openai-agents-python and the JS/TS Agents SDK, the agent-orchestration libraries, which route to OpenAI's coordinated vulnerability disclosure policy OpenAI's first-party services and APIs, which sit on the same Bugcrowd program although they are not open source Out of scope All model-behaviour work, in emphatic terms: "Issues related to the content of model prompts and responses are strictly out of scope for the Security and Safety Bug Bounty programs, and will not be rewarded unless they have an additional directly verifiable security impact on an in-scope service" Jailbreaks and safety bypasses by name, including DAN and related prompts, getting the model to say bad things, and getting the model to write malicious code for you Code execution from within the sandboxed Python interpreter: "This is an intended product feature", and the same for Agent Mode, which runs in a separate contained environment root access inside the container tool, which is not a privilege escalation because the root user has no special privileges outside a gVisor sandbox with no external network Model hallucinations, including getting the model to pretend to be a computer and execute code Safety and abuse issues, which belong to the separate OpenAI Safety bug bounty rather than to this one Anything outside Bugcrowd's asset list, which needs an authenticated session to read: the public proof that openai/codex is a paying target is the repository's SECURITY.md rather than a scope row, so confirm the live list before you start Most-valued findings A sandbox escape out of the Codex CLI's own confinement onto the developer's real filesystem or shell. That is the class CVE-2025-59532 landed in, the most damaging thing this tool can do, and the reason code execution is 40% of the expected mix here Code execution reached through attacker-controlled content the agent consumes: a malicious MCP server or a malicious repository, which is the actual exploitation model for a tool that lives on developer and CI machines rather than on public web servers Approval-prompt bypass: any path that gets a command executed without the confirmation step the user believes is protecting them, which turns every other guardrail into decoration Network-control bypass that lets the agent reach the network when policy says it may not, converting a local coding tool into an exfiltration channel for whatever is on the machine Exposure of credentials and secrets from the agent's own configuration, state or logs, since the machines this runs on hold API keys and repository write access by definition Agents SDK defects where untrusted tool output or handoff data crosses into control flow, which is the injection class at 20% and the shape every downstream adapter inherits Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. A Bugcrowd account is required, and OpenAI asks that all vulnerability-related communication run through its Bugcrowd program Jailbreaks, safety bypasses and anything about the content of model prompts and responses are strictly out of scope and pay nothing unless you can show a separate, directly verifiable security impact on an in-scope service Code execution inside the sandboxed Python interpreter, inside Agent Mode or inside a container tool is an intended product feature; to claim an escape you have to show uname -a and whoami output that differs from OpenAI's published sandbox indicators root inside the container tool is not privilege escalation: that container runs under a restrictive gVisor sandbox with no external network access $6,500 is the top of the published standard range; the $100,000 on the brief is a discretionary max-reward hint rather than a band, so do not size your effort against it The proof this repository is a paying target is openai/codex 's own SECURITY.md rather than a scope row, because Bugcrowd's asset table is behind an authenticated session: re-read the live scope in a browser before you start Disclosure Coordinated through Bugcrowd. OpenAI asks researchers to keep vulnerability details confidential until its security team authorises release, which it aims to do within 90 days of receiving the report: a bounded embargo and comparatively mild on its own. The HIGH grade comes from the other clause: vulnerability-related communication is required to run through OpenAI's Bugcrowd program, which is channel exclusivity, so file there yourself and route the report to us afterwards. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability