Codex issue triage injection crossed GitHub Actions runner and cache trust boundaries

Researchers showed that attacker-controlled public issue text entered a Codex-powered GitHub issue-labeling workflow, induced shell activity and enabled access to .NET CoreCLR diagnostic facilities on the Actions runner.

The reproduced chain used a lower-trust issue workflow to inspect Runner.Worker memory, recover automation authority and alter a GitHub Actions cache subsequently consumed by a higher-privilege build. That sequence could affect release and npm OIDC publishing actions downstream. The issue content was not an authorized instruction to run diagnostics, while a later privileged workflow treated cached artifacts as trusted build inputs. The trust boundary spans prompt, runner process, cache provenance and release identity.

This was a controlled researcher demonstration. The source does not prove a malicious Codex npm package was publicly published or that arbitrary GitHub issue reporters can reproduce the chain after the disclosed patch. Require restricted issue-bot tools, isolate diagnostic sockets and worker memory, and bind privileged release caches to reviewed provenance.

Evidence reconciliation and effect boundary. The exploit chain contained distinct authority transfers. The public issue introduced hostile instructions; runner diagnostic interfaces exposed process state beyond a scrubbed environment; and a cache written in a less privileged workflow became input to a trusted release workflow. A successful cache-poisoning demonstration is consequential even without a confirmed malicious release, but its individual steps should not be merged into one generic prompt-injection success metric.