Running Codex with approvals off? A new study found planted attacks got through 95.6% of the time

#What changed

A preprint posted on October 6, HarnessSecurity-Bench (arXiv 2610.07639), tested six coding-agent harnesses, including Codex CLI, Claude Code and GitHub Copilot. Every harness ran the same base model, GLM-5.2, across 2,500 trials, so the comparison isolates the settings rather than the model. Turning on auto-approve raised legitimate task success from 77.1% to 95.4%, but it also raised the share of planted attacks that worked from 29.2% to 95.6%. The authors also found that about half of the security mechanisms they confirmed in these tools are opt-in, so a default install does not have them switched on. @swif_ai flagged the study on X.

#Who is affected

Anyone running Codex without approval prompts, for example with --ask-for-approval never (-a never) or --yolo (--dangerously-bypass-approvals-and-sandbox), especially in sessions that read untrusted input such as GitHub issues, web pages, tool output or a third-party repo. The attacks in the benchmark were instructions planted in exactly those places.

#What to do now

• Keep the default Auto preset (--sandbox workspace-write --ask-for-approval on-request) for any session that reads untrusted content. Network access stays off by default in that mode.
• For unattended runs, use codex exec --sandbox workspace-write and keep a sandbox in place. -a never works with every sandbox mode, so turning off prompts does not have to mean turning off the sandbox.
• If commands need the network, enable the network_proxy feature with an explicit domain allowlist instead of open outbound access.
• If prompts slow you down, try approvals_reviewer = "auto_review" so a reviewer agent checks escalations rather than skipping them. It uses extra model calls.
• Save --yolo for a container you treat as the security boundary, with repos you trust.
• In the paper, command allowlists and denylists cut attack success with little or no loss in task success, while network isolation and read-only mode blocked nearly everything but cost more utility.

#What is not confirmed

All tests used one substitute model, GLM-5.2, not GPT-6 Astra or GPT-6.1 Sol, so the 95.6% figure will not map directly onto Codex running OpenAI models, and Codex's own model-side safety monitoring was not part of this setup. The paper is a preprint and has not been peer reviewed. The authors also warn that allowlists can leave other execution paths open: allowing python, for example, allows anything Python can do.