OpenAI patches named macOS security vulnerability CVE-2026-100754 in Codex

If you use OpenAI Codex on a Mac, stop what you are doing and check your version number. OpenAI has patched a named security vulnerability, CVE-2026-100754, in Codex version 26.924.20706 for macOS. The fix was credited to Patrick Wardle of the Objective-See Foundation, one of the most respected names in macOS security research. If you are running an older version of the Codex desktop app, you are exposed.

What was the vulnerability?

The specific technical details of CVE-2026-100754 have not been published in full alongside the changelog entry, which is normal practice. Researchers and vendors typically allow a patch to reach users before disclosing the mechanics, to avoid giving attackers a working blueprint before people have had a chance to update.

What we do know: this is a macOS-specific flaw. The CVE designation and the credit to Wardle both signal that it was discovered through responsible disclosure, meaning Wardle reported it to OpenAI privately and gave the team time to fix it before any public announcement.

Wardle, who founded the non-profit Objective-See Foundation, writes free open-source security tools for Mac users and has spent years finding vulnerabilities that others miss. His background includes stints at NASA and the NSA, and he is the author of the Art of Mac Malware book series. He has been particularly active in scrutinising AI agents on macOS through 2026, having separately identified a zero-day flaw in Meta’s Muse AI agent in September 2026. His concern, stated plainly: “We’re super paranoid about what we run on our systems, and then we’re basically allowing these AI agents to do whatever they want.”

That framing matters. Codex is not a passive tool. It writes and runs code, interacts with your filesystem, and can make network requests on your behalf. A vulnerability in that context carries more potential impact than one in, say, a read-only document viewer.

This is not the first Codex macOS security issue

CVE-2026-100754 is a separate flaw from CVE-2026-14898, an earlier vulnerability in the Codex desktop app for macOS documented by SentinelOne. That earlier flaw exploited the app’s automatic rendering of remote images referenced in Markdown returned by the language model. An attacker who could plant an indirect prompt injection could steer the model into constructing an image URL containing sensitive session data, causing Codex to fetch that URL and transmit the data to an attacker-controlled server, with no separate click required from the user.

There is also a broader pattern worth noting. In an earlier, separate incident, OpenAI required all macOS users across ChatGPT, Codex, Atlas, and Codex CLI to update their applications to receive refreshed security certificates. And in March 2026, Check Point Research documented a now-patched vulnerability in which malicious GitHub branch names could inject commands during task setup and retrieve GitHub authentication tokens.

The thread connecting all of these: AI coding agents on macOS have become a meaningful attack surface, and researchers are paying close attention.

What does this mean for you?

If you use Codex on macOS, the action is simple: update to version 26.924.20706 or later. You can check your current version in the app and update through the usual channel for your installation method.

If you use the Python package, the corresponding release is openai-codex==0.154.0, which includes the openai-codex-cli-bin==0.154.0 runtime. Update via:

pip install --upgrade openai-codex==0.154.0

Python 3.10 or later is required.

If you manage Codex deployments across a team or an organisation, this is the kind of update worth pushing proactively rather than waiting for users to apply it themselves. Codex had more than 2 million weekly active users as of early 2026, and many of those are developers with elevated access to codebases, secrets, and production systems. That makes timely patching more consequential than it might be for a consumer app.

The broader point

The pace of AI agent development has been fast, and security has sometimes struggled to keep up. Wardle put it well: the careful habits people apply to software they install deliberately tend not to carry over to AI agents that operate with significant autonomy. CVE-2026-100754 is a reminder that these tools deserve the same scrutiny as any other privileged software running on your machine.

OpenAI crediting Wardle publicly in the changelog is a good sign. It reflects a functioning responsible disclosure process, and it means users got a patch before a working exploit was in the wild. That is how it should work. The job now is to make sure the patch actually reaches people.

Update Codex. Do it now.