Codex CLI PreToolUse Guardrail Tamper or Unhooked-Surface Evasion
This detects someone trying to disable, delete, or route around the AgentShield safety hook that checks commands before OpenAI Codex CLI runs them. It watches for file edits to the guardrail's config or state, explicit disable flags/env vars, and obfuscated commands sent through tool paths that aren't covered by the hook.
How the attack works
An attacker (or a compromised agent) first targets the guardrail's own state, deleting, moving, or overwriting files like .codex/config.toml, .codex/hooks, or the AgentShield/correlation-tracker state — via shell commands or file-write tools. Separately or alongside, they may set CODEX_/AGENTSHIELD_/NETZILO_ environment variables to disable or bypass checks, pass flags like --disable-hooks or --dangerously-bypass-*, or flip a [hooks] TOML setting to off. As a third path, they smuggle an obfuscated payload (base64-decoded, piped to a shell, backgrounded with nohup/setsid) through tool surfaces that the guardrail doesn't inspect, such as unified_exec, local_shell, or web_search. Each of these is a standalone, visible action — the rule does not need to see the guardrail's internal allow/deny decisions to catch them.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7f3c1e2a-9d64-4b57-a1c8-6e0f2b5d84c9
- Severity
- Medium
Why it matters
If successful, this lets an attacker run commands that the safety guardrail was meant to block, effectively giving a Codex CLI agent unchecked command execution on the host.
What you can do
- →Restrict who can modify the .codex directory and guardrail config files, and monitor for unexpected writes or deletes there.
- →Alert on any use of disable/bypass environment variables or CLI flags tied to the hook system, even in scripts.
- →Review use of un-hooked tool surfaces (unified_exec, local_shell, web_search) for obfuscated or encoded command payloads.
- →Treat this as an audit signal only — since the guardrail already blocks dangerous calls synchronously, use these alerts to investigate intent, not as the sole control.
Known benign look-alikes
- Operator or installer cleanup of a corrupted Codex state directory, e.g. rm -rf ~/.codex/sessions after an upgrade — suppressed only when it appears as a package-manager install/upgrade line; a bare interactive rm will still report.
- Dotfile management (chezmoi, stow, Ansible, Nix home-manager) templating or symlinking ~/.codex/config.toml, which surfaces as mv/chmod plus that path.
- Log rotation or disk cleanup scripts that truncate or tee ~/.codex/logs.
- Legitimate CI automation that exports CODEX_*_DISABLE=1 to run Codex headless in an already-isolated sandbox.
- Security engineering or incident-response work that edits AgentShield hook configuration on purpose; expected to report and be dispositioned as authorised change.
- A web_search or unified_exec argument that quotes an unrelated shell one-liner containing a pipe-to-shell string, e.g. researching an installer command.
- Documentation or test fixtures describing hook disablement — mitigated by filter_docs_tests.