Security researchers describe how a malicious GitHub issue could have put the Codex release pipeline at risk. Depi says OpenAI fixed the core flaw.