The coding agent just got owned before it started. at pwn2own ireland on oct 8, researchers hit…
the coding agent just got owned before it started. at pwn2own ireland on oct 8, researchers hit openai's codex with a single argument-injection flaw in its --repo flag, running shell commands during clone.
the agent now needs a bouncer for its own inputs.
Context
Verified event date: Zero Day Initiative's Pwn2Own Ireland 2026 Day One results, dated Oct 6, 2026, record Ikotas Labs, Inc. using a single argument injection bug to exploit OpenAI Codex, winning $40,000 and 4 Master of Pwn points. AI Coding Agents was one of seven target categories this year.
Infosec.ge's day-one write-up says the researcher found Codex does not sufficiently sanitize the repository URL passed to its --repo flag before the clone phase, and that a crafted URL carrying argument-injection payloads got past it.
The single argument-injection bug, OpenAI Codex as the target and the --repo flag match ZDI and the write-up. The post says Oct 8; ZDI's Day One post is dated Oct 6 (Infosec.ge dates day one Oct 7, a conflict with ZDI's own page). The contest ran Oct 6 to 9 in Cork. Running shell commands during clone was not seen in the sources read, so unsupported here, not refuted. 'The agent now needs a bouncer for its own inputs' is the author's.
'the coding agent just got owned before it started' is the author's opinion.
Related work
Watch next
- Check whether OpenAI has published a fix for the --repo handling.
Sources
- Zero Day Initiative, Day One Results, Oct 6, 2026thezdi.com
- Infosec.ge, Day 1 write-upinfosec.ge
- Zero Day Initiative, Pwn2Own Ireland 2026 ruleszerodayinitiative.com
Provenance
The note above is reproduced unedited from the original post, first published on Threads on 11 October 2026 at 10:05 IST. Sources are the papers and datasets the note draws on.
View the original post ↗Embed this note
More notes
The air is now being asked to keep its own ledger
the air is now being asked to keep its own ledger: ecmwf’s aifs compo becomes the first ai model to forecast atmospheric composition globally every three hours, cleanair simulates 365 days of pm2.5 over china in ten seconds, and a unified framework maps six pollutants at one kilometer across the whole country. the air now files its own composition report.
read the note →The current is now being asked to draw its own map
the current is now being asked to draw its own map: china’s langya 2.0 predicts six ocean phenomena including internal waves and mesoscale eddies, a deep net called wenhai resolves eddies globally with air sea flux formulas built in, and scripps infers surface currents from the way temperature patterns deform in satellite images. the ocean now files its own circulation report.
read the note →The soil is now being asked to report its own carbon
the soil is now being asked to report its own carbon: a nix color sensor paired with generative data augmentation predicts soil organic carbon without a lab, random forest drives 74 percent of soil health mapping studies, and sentinel 2 tracks five year carbon change across france and italy from 922 samples. the dirt now files its own carbon account.
read the note →