Codex desktop app for macOS auto-fetched attacker-crafted image URLs, letting indirect prompt injection exfiltrate session secrets

Undisclosed·OpenAI Codex desktop app for macOSFixed

Codex's macOS desktop app auto-rendered remote images referenced in Markdown inside model responses; an attacker who planted an indirect prompt injection in content the agent processed (e.g. a connected tool's output) could make the model construct an image URL encoding sensitive session data, which the app then fetched automatically, sending that data to an attacker-controlled server with no separate user click.

Blast radius

Per NVD, could have exfiltrated API keys, source code, and other data returned by connected tools accessible in the Codex session; NVD states no direct integrity or availability impact was demonstrated and there is no known exploitation in the wild, so real-world blast radius is not disclosed.

Root cause

The desktop app auto-fetched remote image URLs embedded in model-generated Markdown without gating or sanitizing them, so a model steered by untrusted injected content could turn image rendering into an outbound data channel.

How it was caught

Identified and reported as a vulnerability (assigned CVE-2026-14898) rather than caught via an in-the-wild attack; NVD/CISA-ADP record notes no known exploitation.

What changed

OpenAI shipped a fixed Codex desktop build (versions before 26.527.31326 are listed as affected), implying remote image auto-fetch behavior was changed or gated in that release.

Take-awayAgents that render Markdown or HTML from model output should never auto-fetch remote URLs (images, links) sourced from untrusted or model-generated content without sanitization or explicit user confirmation, since URLs can be used to smuggle exfiltrated data.