Codex tokens were exfiltrated via a popular npm package, affecting users since v0.1.82 and enabling persistent account access ...

The tool gathered over 29,000 downloads before the malicious npm package was identified ...

The codexui-android npm package silently exfiltrated OpenAI Codex auth tokens to an attacker server for a month, affecting 29,000 weekly downloads.

OpenAI and 1Password unveil a partnership that will provide Codex with secure access to credentials as part of new approach to agentic security.

OpenAI’s Advanced Account Security lets ChatGPT and Codex users replace passwords with passkeys or security keys, but recovery is limited.