Version 13

What

Why it matters

Open questions

• Article titles suggest a patch was issued for a supply chain vulnerability [11] and that an MCP security gap was disclosed [12] — do these address any of CVE-2025-59532, CVE-2025-61260, or ZDI-26-305, or do they represent additional undisclosed vulnerabilities beyond the three already tracked?

• GovCloud availability [1] expands Codex into regulated government infrastructure — what security controls or FedRAMP-equivalent accreditations accompany it given three publicly documented, unpatched CVEs?

• The 'Sites' feature and 'Next Era of Knowledge Work' report [3][4] position Codex as a general productivity platform — does this represent real architectural expansion or a rebranding of existing capabilities under competitive pressure?

• Ramp's AI Index reports Anthropic has overtaken OpenAI in business AI adoption [15][16] — does the AWS/Bedrock distribution shift change that competitive picture, or does it deepen reliance on third-party channels rather than direct enterprise relationships?

Narrative

Timeline

• 2026-04-21: OpenAI reports 4M+ weekly active developers, launches Codex Labs, and names seven GSI partners (Accenture, Capgemini, CGI, Cognizant, Infosys, PwC, TCS) [2][47]
• 2026-05-08: OpenAI publishes 'Running Codex safely at OpenAI' as an enterprise security reference documenting sandboxing, approvals, and agentic telemetry [31]
• 2026-05-14: Codex launches in ChatGPT mobile app on iOS and Android in preview; Sea Limited case study published [24][48][49]
• 2026-05-15: OpenAI publishes engineering retrospective on the Windows sandbox, detailing rejected security primitives and the final composed architecture [32]
• 2026-05-16: Codex Windows app launches in Microsoft Store; community user reports Codex wiped files on their machine [50][51]
• 2026-05-18: OpenAI and Dell Technologies announce partnership for hybrid and on-premises enterprise Codex deployment [25][42][43]
• 2026-05-20: UiPath treats Codex, Claude Code, and GitHub Copilot as interchangeable selectable components; Infosys publicly positions as model-agnostic [19][20][18]
• 2026-05-21: GitHub formally launches Claude and Codex as selectable agents in Agent HQ; GPT-5.3-Codex reported as new Copilot Business/Enterprise base model [37][38][52]
• 2026-05-22: Gartner 2026 Magic Quadrant names OpenAI, GitHub, and Cursor as Leaders (Cursor furthest right); CVE-2025-59532 disclosed; Virgin Atlantic case study published (78–80% codebase reduction, zero P1 defects) [22][40][36][53][54][26]
• 2026-05-23: Check Point Research characterizes CVE-2025-59532 as command injection with a public Docker-based proof-of-concept; Codex Security research preview announced [5][34][55]
• 2026-05-24: Dell confirms Grok 2.5 deployment on identical Codex infrastructure; Codex Security reports 1.2M commits scanned and 10,561 high-severity issues [21][33]
• 2026-05-25: Multiple sources report OpenAI Q1 2026 revenue at ~$5.7B; critical analysis reports –122% Non-GAAP operating margin; Ramp AI Index reports Anthropic overtook OpenAI in business AI adoption [46][17][56][15][16]
• 2026-05-27: Cisco (10–15x defect throughput, 1,500+ engineering hours saved monthly) and Warp (90% agent-created PRs, 35x ARR growth) case studies published [27][28]
• 2026-05-29: Braintrust case study published (50% engineering adoption in one month); Codex Computer Use launches on Windows; widespread sandbox setup failures and CLI tmux escape documented immediately [30][57][35][58]
• 2026-05-30: ZDI publishes ZDI-26-305 as a zero-day; BeyondTrust documents GitHub token exposure via command injection; Cymulate names 'Configuration-Based Sandbox Escape' (CBSE) as an AI coding tool vulnerability category [6][10][45][8][9]
• 2026-05-31: CVE-2025-61260 (RCE) disclosed by SentinelOne; Windows Computer Use UAC and spawn failures continue with no confirmed stable release [7][59][60]
• 2026-06-01: Codex launches on AWS/Amazon Bedrock covering Commercial and GovCloud regions; 5 million weekly users reported; Daybreak cybersecurity suite planned for future AWS availability [1]
• 2026-06-02: Codex repositioned as general knowledge-work platform with new 'Sites' feature enabling interactive web experience creation from plain-language instructions [3][4]

Perspectives

Tensions

• OpenAI published 'Running Codex safely at OpenAI' as an enterprise security reference [31] and expanded into GovCloud [1], but CVE-2025-59532 [6], CVE-2025-61260 [7], and ZDI-26-305 [8] remain publicly disclosed without confirmed remediation, and a newly disclosed MCP security gap [12] extends the unresolved exposure into government-adjacent infrastructure. [31][6][7][8][1][12]
• Cymulate frames CBSE as a category-level vulnerability pattern affecting AI coding tools broadly [10], while BeyondTrust specifically documents GitHub token exposure via Codex's command injection in enterprise deployments [9], together suggesting OpenAI's security reference model [31] systematically understates the attack surface. [10][9][31]
• OpenAI's scale narrative claims 5M+ weekly users and ~$5.7B Q1 2026 revenue with Codex as a driver [1][46], while Ramp's AI Index reports Anthropic has overtaken OpenAI in business AI adoption [15][16] and a critical analysis reports a –122% Non-GAAP operating margin [17]. [1][46][17][15][16]
• The 2026 Gartner Magic Quadrant provided OpenAI its first major analyst validation [22], but GitHub earned the same Leader designation for the third consecutive year [36] and Cursor is confirmed furthest right [40], reflecting category maturity across incumbents rather than a breakthrough for any new entrant. [22][36][40]
• OpenAI markets Codex as a uniquely positioned enterprise platform, but Infosys — one of its seven named GSI partners — publicly positions as model-agnostic [18], UiPath bundles Codex alongside Claude Code and GitHub Copilot as interchangeable components [19][20], and Dell simultaneously deploys Grok 2.5 on identical infrastructure [21]. [19][20][18][21]
• All named enterprise performance claims — Virgin Atlantic's 78–80% codebase reduction [26], Cisco's 10–15x defect throughput [27], Warp's 90% agent-created PRs [28], Braintrust's 50% adoption in one month [30] — originate exclusively from OpenAI-controlled or co-published materials with no independent technical verification. [26][27][28][30]