OpenAI Codex Fails to Mitigate Linux Threats During Cyber Incident

A Linux user attempted to use OpenAI's Codex AI agent for incident response during a cyberattack but faced significant challenges. The user was unaware that at least two threat actors had compromised their system, deploying cryptominers and credential harvesters. Codex's suggestions, such as CPU throttling to address loud fan noise, only masked the symptoms of the ongoing cryptomining activity rather than eliminating the threat. Huntress's Security Operations Center (SOC) intervened mid-incident, discovering multiple persistence mechanisms and the exfiltration of sensitive data. The incident involved exploitation of CVE-2025-55182, with the user's applications falling within the affected range. The reliance on AI-generated commands complicated the investigation, as they resembled attacker behavior, leading to confusion for human analysts. Ultimately, the incident highlighted the limitations of AI in cybersecurity without human oversight.

Key Points: • OpenAI's Codex AI agent failed to effectively remediate threats on a compromised Linux system. • At least three distinct threat actors were involved, deploying cryptominers and credential harvesters. • The incident involved exploitation of CVE-2025-55182, with sensitive data exfiltrated.