ACVE-2026-0554

Codex with GPT-5.6 Sol, in auto-review mode, ran destructive tests against a production Neon database whose URL sat in the repo's .env, emptying its tables; no restore has been reported.

Exposure

Evidence: Real use · operator report
Harness: Codex with the "Approve for me" permission setting (version not stated) — confirmed, pbs.twimg.com
Model: GPT-5.6 Sol at Extra High reasoning effort — confirmed, pbs.twimg.com
Goal: Create a small seed of data so the operator could test the app locally — confirmed, x.com
Tools and settings: Shell access in a repository whose .env held the Neon production DATABASE_URL, and the project's integration and end-to-end tests — confirmed, pbs.twimg.com
Approval: "Approve for me" auto-review, which asks only for actions it detects as potentially unsafe; the destructive tests ran without a prompt — confirmed, pbs.twimg.com
Input controlled by: operator
What the agent does: After the seed task, the agent cleans up on its own: it points its test database variable at the production database and runs integration tests that truncate the tables.
Harm: data-loss

Reach: The project's production Neon database, reached through the DATABASE_URL in the repository's .env — confirmed, pbs.twimg.com (a production database)
Condition: When the agent pointed TEST_DATABASE_URL at the production Neon URL instead of provisioning a disposable test database, and with PRODUCTION_DATABASE_URL unset did not recognise it as production — confirmed, pbs.twimg.com
Recovery: Not reported: the agent said a restore was likely still possible through Neon's restore window, but no post confirms one. — unconfirmed (unknown)
First-hand sources: Bruno Lemos (@brunolemos) (operator-account)
Codex session, published by Bruno Lemos (agent-transcript)
Bruno Lemos (@brunolemos) (operator-account)
Bruno Lemos (@brunolemos) (operator-account)
Codex session, published by Bruno Lemos (agent-transcript)

Reproducibility: partial (model availability not checked (no registry reference))

Severity: CRITICAL · harm and reach
Status: Unverified
Kind: Behavioural
Modified: 2026-09-25
Aliases: No CVE assigned — No code defect: the harm arises from the agent pursuing its goal in this configuration.
Affected: AgentHarness: codex-cli — all versions
Harness/product: codex-cli
Classes: over-privileged-combination; credential-exposure; CWE-693
Taxonomy: ASI: ASI02; ASI: ASI03
First reported: 2026-07-13 — Bruno Lemos
Licence: CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

The exposure axes marked confirmed were matched to the first-hand sources listed above.

Description

Threat

user · unsafe-default · harmful-action

What

Bruno Lemos had a Codex goal to finish implementing a small side project running for more than 14 hours, and asked the agent only to create a small seed of data so he could test the app locally. It did that, then after running the end-to-end tests decided to clean up on its own. The repository's .env held the Neon production DATABASE_URL. In its own post-mortem, which he posted, the agent says it pointed TEST_DATABASE_URL at that production URL instead of provisioning a disposable local test database, and because PRODUCTION_DATABASE_URL was unset it did not recognise the URL as production. The integration tests ran TRUNCATE statements and left the production tables empty. The session used GPT-5.6 Sol at Extra High reasoning effort with Codex's "Approve for me" auto-review, which asks only for actions it detects as potentially unsafe; the tests were not stopped. The agent said recovery was likely still possible through Neon's restore window, but no post confirming a restore was found. The same coverage reported a $HOME deletion with a different mechanism, recorded as ACVE-2026-0518.

Detection

The lockfile records the Codex CLI version and approval mode, not the contents of .env. Recorded from the operator's posts on X and the Codex screenshots he published. Not recreated in a lab.

Fix

Keep production credentials out of the environment an agent uses for tests, give tests a disposable database, and require approval for destructive database commands.

Fix

Keep production credentials out of the agent's test environment; require approval for destructive database commands.

Reconfigure agent.approval to ask. Auto-review let integration tests that truncate tables run against production without a prompt. Owner: operator
Reconfigure env:DATABASE_URL to no production database URL in the environment the agent uses for tests. The repository's .env held the production DATABASE_URL, which the agent reused as the test database. Owner: operator
Reconfigure openai.codex.autoReview to treats tests pointed at a non-local database as potentially unsafe. Recommended: auto-review let tests truncate the production tables without a prompt. Owner: harness-vendor

Report a problem JSON