Codex Botnet Recruitment via Injected Fetch-to-Execute
An attacker hides instructions inside content that a ChatGPT Codex agent reads, tricking the agent into using its one allowed internet path to download and run attacker code. This can turn the agent's sandbox into a remotely controlled bot that checks in for further commands.
How the attack works
An attacker plants a prompt injection somewhere the Codex agent will read it, such as a file, webpage, or dependency description. The injected instructions abuse the sandbox's Common Dependencies Allowlist — its only permitted outbound network path — to fetch attacker-hosted code. The agent runs that code using a fetch-then-execute pattern (curl or wget piped to a shell, base64-decoded payloads, or inline python/node that downloads and executes remote content). The downloaded code also installs a persistence or remote-control mechanism, such as a beacon loop, reverse shell, cron/systemd job, or daemonised background process. Once running, the compromised sandbox may phone home to a command-and-control endpoint using a bot identifier paired with a task or command field, indicating it is now waiting for instructions.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9f3c1d47-58ba-4e21-b6d0-72c4e8a19f35
- Severity
- High
Why it matters
A compromised agent sandbox can be remotely controlled, used to run arbitrary attacker code, and potentially serve as a persistent foothold or launch point for further activity, all while consuming the organisation's compute and network access.
What you can do
- →Restrict or monitor what the Common Dependencies Allowlist can reach; treat it as a sensitive egress path rather than a routine one.
- →Review agent sandbox command lines for the combination of a fetch-and-execute pattern together with persistence markers (cron, systemd, nohup, reverse shells) — either alone is common, both together is not.
- →Watch outbound HTTP requests from agent sandboxes for URIs or JSON bodies that pair an identifier field (agent_id, bot id) with a command/task field.
- →Before enforcing on this pattern, measure its false-positive rate in your environment, since legitimate bootstrap scripts and health-check loops can look similar.
Known benign look-alikes
- Dev-container or CI bootstrap that installs a toolchain with a vendor install script (curl piped to sh) launched under nohup or setsid — matches delivery plus a control marker without malicious intent.
- Long-running health-check or deployment scripts that poll an endpoint in a "while true; do curl ...; sleep N; done" loop and were themselves installed by a fetch-and-run bootstrap in the same command line.
- Monitoring or telemetry sidecars that check in over HTTP with an agent_id and a task field in the JSON body (legitimate task-queue workers use the same shape).
- Deliberate red-team, malware-analysis or security-training exercises executed inside the agent sandbox by an authorised operator.
- Chat-bot integrations whose URI happens to contain /bot/command style routing.