OpenAI is full of holes in the world, and it's been blown up by Chinese AI!

  It's the first time in the history of the world.

It's a bit magical.

OpenAI is sending AI around the world looking for vulnerabilities in software.

In March, they released Codex Security, a tool dedicated to AI to help developers around the world crack security flaws.

At the end of July, OpenAI opened the Codex Security CLI directly and installed the npm install command line.

It even gave it a fairly moderate and somewhat offensive name:

Patch the Planet patches the Earth.

That's a good guy.

The Earth's patches aren't done yet, and the codex itself has been drilled into a hole.

It was discovered by an AI security defense system from China.

OpenAI spent half a year telling the world, "I can help you find the vulnerability", and in retrospect, its doors were not locked.

This vulnerability is not a complicated term for hackers.

Codex usually has a safety valve: it pops a window before you do anything on your computer and asks you: Is this a risky operation, or should you let it go?

You click "agree" and it moves, and you click "refuse" and it stops.

But this vulnerability was discovered.It's a great way to get around this gate.

The newest vulnerability discovered by Theron is related to Codex's curated Git plugin synchronization mechanism.

The problem is not the 6th Codex high-value vulnerability that was uncovered in August, but an entirely new attack path.

Normally, if you want the codex to perform cross-border operations on your computer, you should first ask the question, "Do you not allow it?"

You agree, it works.

This is also the psychological bottom line for 25 million codex users around the world to put an AI that can read files, change code and run commands into a computer.

OpenAI's own security documentation is also designed this way: Sandbox is responsible for outlining what the Codex can do, and when high-risk actions cross borders, approval mechanisms require user confirmation.

This is where the problem gets a little out of hand.

The vulnerability occurs when the codex itself launches the sync link.

In other words, the attack is not an actual line-up waiting for AI to raise its hand to apply for permission.

It went through the side door.

Even before that familiar "Permit execution" window pops up, dangerous operations may have already occurred.

The lock was still hanging on the door, and the rope had gone through the wall.

More importantly, this was not an accident.

In fact, Codex's own public code record has long been obscured by pencils.

The plug-in automatically synchronizes the process when the plug-in is launched, and the plug-in is not enclosed in the codex security fence. It belongs to the codex's own "driving readiness", not the sandbox tube.

In July, a Codex Public Issue showed that the Git operation in the synchronization process had inherited the wrong environmental variables, acting directly on the user's own code repository, and may even perform a reset -- hard.

In other words, it copied the login credentials and server keys on the developer's computer into its own sync commands, which the developer was unaware of.

In particular, the report notes that even if the codex is started with a read-only sandbox, this part of the start sync is not in the sandbox because it is part of the codex's own start mechanism.

This is a very important sentence.

Because it means that where AI programming tools are really dangerous today is no longer just that "models will fail to execute commands".

In addition to the model, there is an increasingly complex set of Agent infrastructures - plugins, Git, MCP, terminals, credentials, sandboxes, auto-approval, back-end synchronization - wherever there is a gap, it can be another door.

What happens when this door is opened by hackers?

A lot of people see this, and they might think, is this a bug in a programmer's computer, and what does this have to do with me?

The relationship may be much bigger than you think.

Let's say there is an open-source payment component that is used by hundreds of thousands of apps.

One day, an attacker submits a code. The name is a little scary, and it's like a very active program: "optimize invoice query performance".

One developer pulled the project to the site and opened it with the codex.

He didn't do anything. There was no "running", no "permission", and he didn't even get through the code.

But at the moment it was opened, the attackers' orders had been quietly executed.

The "Allow/Deny" button, which was responsible for closing the door, was like a late cop in a movie. When it came out, the scene was over.

In the meantime, the real danger is just beginning.

Because developers' computers may have GitHub Tokens, cloud server credentials, code storage permissions, CI/CD keys, software signature certificates, and even produce environment inputs.

If the attacker gets these things, it's the equivalent of getting the developer's own work permit, office keys, extra credentials.

What he really wanted was not to put the computer on a blue screen, which is unimaginable.

What he really wants is:To become a programmerThen mix the toxic code into a future official version.

And then came the most ironic scene.

Users don't go to any wild horse website to download a Tomi. Users actually open their phones and see the familiar tip: "Find a new version, recommend an immediate update".

He pressed the "update" button.

The app is official. The certificate is true. The update channel is true. The developer account is also true.

He spent two months hiding quietly in his cell phone, collecting bank card numbers, validation codes, expiration dates.

One morning, when you wake up in your sleep with a series of cashless text messages, the money is gone.

On this chain:

• First, the developers, the computers and the keys are on the same end;

• And then there's the whole open source community, where one component fails, and thousands of apps are instantly connected to this world-trusted channel called "Official Update".

• Finally, it was you. The only thing I did was turn on the "update".

This is where the software supply chain attacks are really scary:It's not your vigilance that it's attacking, it's your trust.

This is just another iteration of the chain of attacks.

In reality, the issue of security exposed by the Codex is not a single point, but a line that is being ripped open almost every month from May to September this year.

In May, Pwn2Own Berlin 2026 will be held.The world's top security competition, known as the "Hack Olympiad", has unprecedentedly targeted AI programming tools as official targets this year.

Codex, Claude Code, Cursor, none of them left.

On the first day of the competition, security researcher Compass Security broke into the sandbox of the Codex with a vulnerability to enable remote code execution.

Another Doyensec team also found a hole in the codex, but was convicted of "collision" because OpenAI already knew about the vulnerability.

Three days of competition, 47 zero-day gaps, $1,290,000 in prize money.

In August, there was a series of attacks.

Security researchers first reported two vulnerabilities in the Codex sandbox, code overpatch and heapjack.

Heapjack is more dangerous. Developers use codex to open a malicious code repository, and simply asking an AI question about the content of the code can trigger the execution of the command, even if the codex can't stop it in the strictest read-only sandbox.

Subsequently, 360 Dragons uncovered six high-value security vulnerabilities in the Codex once and added the all-new curated git sync 0day.

If an overseas research team breaks a hole in a casino, what Truongchu does is closer to a continuous, bulk, and systematic security screening of the mainstream AI programming tools around the world.

On September 17th, the Plugin 4Shell was released.AIR Security Lab has released a more basic question.

Codex, Claude Code, GitHub Copilot, Gemini CLI are four mainstream AI programming tools that share the same design flaws.

This vulnerability is zero-click. Users don't need to install new plugins, they don't need to press any buttons. As long as one of the regular plugins you've installed is tampered with, the next time you update automatically, the malicious code will come in silently.

From the sandbox to the approval mechanism, from the start-up link to the plug-in ecosystem, the codex's security lines have been layered in half a year.

OpenAI's own Codex Security is busy finding vulnerabilities for others.

Is that ironic?

But the problem with the Codex is not unique. It is just the tip of the iceberg that comes out of the water.

In the last few decades, the world of software, of course, has been plagued by flaws.

But with a human-readable code, a system that measures how much the world can do with this live white hat, the gaps that come up in a year are equal to the storage of silence, nine cows a hair.

AI has completely rewritten this.

On the one hand, AI is starting to write code in bulk, generate components, open source libraries, and the speed of software production is being pulled to a new level, with every new line of code naturally bringing new uncertainty.

On the other hand, AI has begun bulk excavation of the vulnerabilities, which took three to five years to find, and now the model may be wiped out in a few weeks.

At the same time, the speed at which software is built and the speed at which the vulnerability is overcome is stepping on the oil gate.

The most dangerous of all areas is AI programming itself.

The reason is simple: it's at the top of the entire software production chain.

Codex, Claude Code, and Cursor suggested that these tools not only sit in a chat box, but read code directly, change files, run scripts, and even access server and software release processes.

As more and more software starts from the first line of code, AI is next door.

This means that AI programming tools themselves are becoming the "groundwork" on which tens of millions of software depend.

Once utilized, the AI programming tool is contaminated not just by a response, but by the developer's accounts, warehouses, and distribution channels, connecting to the end user's apps, bank cards, smart home and industrial systems.

AI has no malice, but it has developed a pair of "hands that can move". Hands that can reach into the system, this attack is completely different.

It's not because you don't know it doesn't exist.

If the security system finds out first, it's a patch, it's a work order, it's done, and the outside world won't even know it. If the hacker finds out first, it could turn into an accident, a leak, a loss for businesses and users to bear.

What Turun is doing is taking the time to "take the message before it's lit".

Why did a Chinese security company see this hole before OpenAI itself?

The bottom line is that 360 has been working for security for more than two decades, with 360 products running across the country, which is equivalent to a real attack on the entire Internet that has been "listening" for more than two decades.

End-to-end data, traffic information, malicious programs, and attack methods that build up real-world security data are "muscle memories" that train security capabilities.

360 is one of the most vulnerable companies in the history of the world, receiving the highest vulnerability award from Apple, Microsoft, and Google.

At The Pwnie Awards, known as the "hacking Oscars", 360 people have just won the prize for their collaborative research with a team from China Net Research Institute.

What many people don't know is that as early as 2019, 360 broke the record for 12 consecutive years without a Chinese winner of the Pwnie Award, with the "Best Litigation Breach Award".

Since then, the highest-grossing "epic achievement" prize has been awarded in 2020. As of now, 360 have been awarded the "Hacker Oscar" prize for the third time.

More importantly, the routes are different.

There are two main ways in which the industry is digging up the vulnerabilities of AI: either using a general model with security tweaks, and the security experience is "hanging on"; or using a general model with security tweaks, and the model itself doesn't understand security, and is just a "connector".

A third line of roadblocks is a line that uses twenty years of security data to maintain a native model of security, and another line that replicates the entire workflow of top experts into a group of intelligent bees, bi-line collaboration.

It's a craft in its own right to crack down.

Analysis, guesswork, trial and error, change of direction, verification, not one link is missing. This is not something that can be learned automatically by a smarter model.

You have the money to buy a big model, but you can't buy more than 20 years of process data; you have a big model, but you don't have a methodology that breaks down the expert workflow.

Even if you do, you can't replicate the "attack instinct" of more than 30 years of white hat warfare.

The results illustrate the problem: In less than three months of opening up to the outside world, Thuringia has accumulated more than 10,000 security vulnerabilities, 260 of which have been verified by authorities such as the National Library of Information Security vulnerabilities.

Not only the Codex, but it also completed security assessments of mainstream overseas AI products such as Claude Code, Flowise, OpenClaw, and more. Flowise excavated 23 security flaws in 13 0days, OpenClaw, and more than a dozen derivative smartphones.

Nearly 500 enterprises have access to health and safety checks covering key areas such as finance, energy, operators, government, and high-end manufacturing.

It's a systematic set of capabilities that are continuously output.

More importantly, the way it evolved.

Now the whole AI circle is talking about RSI (return to self-improvement) and AI improves itself, the faster it runs.

The RSI pursued by OpenAI and Anthropic is to make the general model spiral upward in reasoning ability, with the goal of making it smarter.

Turing's RSI occurs in a completely different dimension: not to make the model smarter, but to make the defense system more agile every time a real war is being fought.

When AI is added to the attack side, the gap will only increase if the defense side stays at the speed of the man-made patrol.

The meaning of the name is:For the first time ever, the defense has its own self-developing engine.

It concludes with: Encountering problems in real-world tasks→ leaving complete process data→ Abstract-to-movable "how to do"→ Sharing the entire intelligent cell population→ Improving collective capabilities→ Going on to more difficult tasks.

In the past, a smart body has learned a long way, the equivalent of an expert himself; now this set of experiences enters a public pool of experiences that all smart bodies can call directly on.

If one person steps on the pit, the whole team doesn't have to step on it again.

Let's go back to the beginning of the picture.

You're sitting on the couch, and your phone pops up with a push: the new version is ready, is it updated immediately?

What you don't know is that it went through a long journey before this update arrived on your phone:

From the code warehouse of the open-source component, to the local environment of the developer, to the compilation of build servers, to the app store audit, and finally to you.

Every link on this link could be a breakthrough for the attacker.

And now, AI programming tools are at the top of this link -- they write code, review code, run code for developers.

It has its own security frontier, the security frontier of the entire software world.

The Codex series of vulnerabilities teaches everyone a lesson: the security of AI programming tools is no longer a technical issue, but an underlying issue for tens of millions of software.

Every time you score an update, there's a racehorse behind it.

Whoever finds the hole first gets the right to play the game.

This time, the codex vulnerability was first discovered by Theron.