Evidence · DiggingBeagle record
Depi: backdooring Codex through a GitHub issue labeler
Primary or origin disclosure used to qualify the underlying mechanism, stated prerequisites and limits. Public issue body embedded into Codex labeling action with allow-users:*; hostile QA instructions led agent to shell. .NET CoreCLR diagnostic /tmp pipe allowed Runner.Worker process-memory read even though credential env removed. Recovered Actions tokens used for cache poisoning consumed by higher-privileged rust-ci; researchers describe rogue release and npm OIDC trusted publishing chain. OpenAI patched after disclosure.
- Source role
- primary disclosure
Evidence record
Primary or origin disclosure used to qualify the underlying mechanism, stated prerequisites and limits. Public issue body embedded into Codex labeling action with allow-users:*; hostile QA instructions led agent to shell. .NET CoreCLR diagnostic /tmp pipe allowed Runner.Worker process-memory read even though credential env removed. Recovered Actions tokens used for cache poisoning consumed by higher-privileged rust-ci; researchers describe rogue release and npm OIDC trusted publishing chain. OpenAI patched after disclosure.
Claim-level citations (3)
- supportsCodex issue triage injection crossed GitHub Actions runner and cache trust boundaries: Depi researchers report that lower-trust GitHub issue text steered the Codex issue-labeling workflow into runner diagnostics and an Actions cache subsequently consumed by a more privileged pipeline; they do not report shipping a malicious npm release to ordinary users.
Depi technical report, Introduction, CoreCLR diagnostic pipe, Actions cache poisoning and disclosure sections
- supportsCodex issue triage injection crossed GitHub Actions runner and cache trust boundaries: This was a controlled researcher demonstration. The source does not prove a malicious Codex npm package was publicly published or that arbitrary GitHub issue reporters can reproduce the chain after the disclosed patch.
Reproduced chain from public issue prompt through CoreCLR runner memory and Actions cache
- supportsCodex issue triage injection crossed GitHub Actions runner and cache trust boundaries: Researchers showed that attacker-controlled public issue text entered a Codex-powered GitHub issue-labeling workflow, induced shell activity and enabled access to .NET CoreCLR diagnostic facilities on the Actions runner.
Reproduced chain from public issue prompt through CoreCLR runner memory and Actions cache