Identifier / Programs / Linux and Unix
codex
Natural language code assistant for the terminal, powered by OpenAI. Reads and edits files in your current directory to fulfill requests. tldr-pages
GTFOBins shell 1 ATT&CK technique 1 documented command
How codex is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
sandbox
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for codex.
1 documented command
shell unprivileged, with sudo
codex sandbox linux /bin/shThe command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for codex. The identifier reads the line that runs codex.
What detects it
Everyday use
Start an interactive Codex session in the current directory
codexIdentifyRun a single Codex command using a prompt
codex "prompt"IdentifyRun a prompt allowing Codex to edit files in the workspace
codex --sandbox workspace-write "prompt"IdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.