Report · SecurityWeekAbout CVE-2025-61260Published 2 Dec 2025

Vulnerability in OpenAI Coding Agent Could Facilitate Attacks on Developers

Source SecurityWeek

Authoritative record:CVE-2025-61260· Critical 9.8

Not known to be exploited · CVSS 9.8 Critical.

Data as of 3 Dec 2025, 11:50 UTC

CVSS base score

9.8Critical

How severe the flaw is on the 0–10 CVSS scale.

Exploitation evidence

Disclosed: evidence found.
CVE published 14 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
npmopenai/codex-cli`pkg:npm/openai/codex-cli`Other threats	Affected <=0.23.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Until official patches are released, organizations should implement strict access controls on developer machines and the Codex CLI tool, including limiting usage to trusted personnel and environments. Employ application whitelisting and monitor command-line activity for unusual or unauthorized commands. Use endpoint detection and response (EDR) solutions to detect suspicious behavior indicative of exploitation attempts. Educate developers about the risks of executing untrusted commands or scripts via the CLI. Segregate development environments from production systems to contain potential breaches. Regularly back up critical source code repositories and verify integrity. Once patches or updates are available from OpenAI, prioritize their deployment. Additionally, consider using containerized or sandboxed environments for running AI coding tools to reduce the attack surface.

Description

The Codex CLI vulnerability tracked as CVE-2025-61260 can be exploited for command execution. The post Vulnerability in OpenAI Coding Agent Could Facilitate Attacks on Developers appeared first on SecurityWeek .

Impact

For European organizations, this vulnerability could lead to unauthorized command execution within developer environments, risking exposure of proprietary source code, intellectual property, and sensitive configuration data. Compromise of developer machines can facilitate supply chain attacks, insertion of backdoors, or disruption of software delivery pipelines. Organizations in sectors with high reliance on software development, such as finance, telecommunications, automotive, and critical infrastructure, may face increased risk. Additionally, the breach of developer environments can undermine trust in AI-assisted development tools and delay project timelines. The impact on confidentiality and integrity is significant, while availability impact is moderate unless attackers use the vulnerability to disrupt development operations. The threat is heightened by the strategic importance of software supply chains in Europe and the increasing adoption of AI coding assistants.

Summary

The vulnerability identified as CVE-2025-61260 affects the OpenAI Codex CLI, a command-line interface tool used by developers to interact with the OpenAI Codex coding agent. This vulnerability enables an attacker to execute arbitrary commands on the developer's machine by exploiting flaws in how the CLI processes input or commands. Such command execution vulnerabilities can allow attackers to run malicious code, potentially leading to unauthorized access to source code, credentials, or other sensitive information stored or processed in the development environment. The lack of known exploits in the wild suggests that the vulnerability is either newly discovered or not yet weaponized, but the risk remains significant due to the privileged access developers typically have. The affected versions are not specified, and no patches or mitigations have been published yet, indicating that organizations must rely on interim protective measures. The vulnerability's medium severity reflects the balance between the potential impact and the current exploitation status. The threat is particularly relevant to organizations leveraging AI-assisted coding tools, which are increasingly common in modern software development workflows.

References

securityweek.com/vulnerability-in-openai-coding-agent-could-facilitate-attacks-on-developers/ (opens in a new tab)

Community reviews

Loading reviews…