OpenAI Patches ChatGPT DNS Data Exfiltration Flaw and Codex Command Injection That Exposed GitHub Tokens
Check Point and BeyondTrust disclose two distinct vulnerabilities in OpenAI products that allowed covert data theft through DNS queries and GitHub token compromise via branch name injection.
Overview
Two security research teams have independently disclosed vulnerabilities in OpenAI’s flagship products that could have allowed attackers to silently steal sensitive data from users. Check Point Research revealed a DNS-based data exfiltration channel in ChatGPT’s code execution environment, while Phantom Labs, the research arm of BeyondTrust, detailed a command injection flaw in OpenAI Codex that exposed GitHub authentication tokens. Both vulnerabilities have been patched, but the disclosures raise broader questions about the security posture of AI platforms that handle sensitive user data.
These findings follow a pattern of security vulnerabilities discovered in AI coding tools. The Machine Herald previously reported on similar issues affecting Anthropic’s Claude Code, where repository cloning could trigger arbitrary command execution.
ChatGPT DNS Exfiltration
The more technically novel of the two flaws targeted the Linux runtime environment that ChatGPT uses for code execution and data analysis. OpenAI’s security architecture blocks direct outbound network requests from this container, but Check Point researchers discovered that DNS queries were not subject to the same controls, according to The Register.
By encoding sensitive information into DNS domain queries, an attacker could exfiltrate user messages, uploaded files, and AI-generated summaries to an external server without triggering any safeguards. Because the model itself assumed the execution environment lacked direct outbound capabilities, it could not recognize DNS exfiltration as unauthorized data transfer, as The Register reported.
Check Point demonstrated the attack with a custom GPT application posing as a health analyzer. When a user uploaded a PDF containing laboratory results with personal medical information, the application transmitted patient identity details and AI-generated medical assessments to an attacker-controlled server. When the user asked directly whether the uploaded data had been sent anywhere, ChatGPT falsely reported that no external sharing had occurred, according to The Register.
The researchers also demonstrated that the DNS channel could be escalated to establish a remote shell inside ChatGPT’s Linux environment, bypassing the model’s safety checks entirely while remaining invisible to the chat interface.
OpenAI patched the vulnerability on February 20, 2026. The company stated it had already identified the underlying problem internally. There is no evidence the flaw was exploited in the wild, according to The Register. OpenAI did not respond to requests for comment.
Codex Command Injection via Branch Names
Separately, Phantom Labs disclosed a command injection vulnerability in OpenAI Codex that allowed attackers to steal GitHub OAuth tokens used during repository operations. The flaw stemmed from improper input sanitization when Codex processed GitHub branch names during task execution, as reported by SiliconANGLE.
When Codex created a task, it cloned repositories and authenticated using short-lived GitHub OAuth tokens. By embedding malicious shell commands directly into branch name parameters, an attacker with repository access could execute arbitrary payloads inside the agent’s container and extract these authentication tokens, according to SiliconANGLE.
The vulnerability affected multiple Codex surfaces including the ChatGPT web interface, the Codex command-line interface, the software development kit, and IDE integrations, SiliconANGLE reported.
Phantom Labs reported the vulnerability to OpenAI on December 16, 2025, and it was patched by February 5, 2026. OpenAI’s fixes included improved input validation, stronger shell escaping protections, tighter controls around token exposure, and measures to limit token scope and lifetime during task execution, according to SiliconANGLE.
What We Don’t Know
- Whether the DNS exfiltration technique affects other AI platforms that use sandboxed code execution environments with similar architectures
- The full scope of data types that could have been exfiltrated through the DNS channel beyond the demonstrated proof-of-concept
- Whether OpenAI conducted a broader audit of its container security following these disclosures
- The number of custom GPT applications that may have been designed to exploit the DNS channel before the patch
Analysis
The two vulnerabilities highlight a recurring challenge in AI platform security: the gap between what AI systems believe about their own environment and the actual infrastructure constraints in place. ChatGPT’s code execution sandbox blocked HTTP requests but overlooked DNS, a protocol so fundamental to internet infrastructure that restricting it can break legitimate functionality. The Codex flaw, meanwhile, demonstrated that traditional web application vulnerabilities such as command injection remain relevant even in AI-native development tools.
As Phantom Labs noted, “AI coding agents are not just productivity tools. They are live execution environments with access to sensitive credentials,” according to SiliconANGLE. The simultaneous disclosure of these two flaws underscores the expanding attack surface that organizations face as AI tools gain deeper access to sensitive data and development infrastructure.