#1
#1 out of 1100.00%
technology3h ago
Your AI coding tool might be leaking GitHub credentials
- Latest: Researchers show a branch-name trick can steal GitHub tokens through Codex by injecting hidden payloads.
- Attack uses Ideographic Space characters (U+3000) to conceal payloads from human eyes in the UI.
- The flaw affects multiple Codex interfaces, including ChatGPT, Codex CLI, SDK, and IDE extension.
- Tokens stored locally in auth.json can amplify the impact if token theft occurs.
- Experts advise least-privilege policies and ongoing monitoring to mitigate risk.
- OpenAI has remediated the reported issues in coordination with security teams.
- The attack demonstrates risks of AI agents with privileged access to code repositories.
Vote 0