---
id: 2435
title: "Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/codex-remote-ui-steals-ai-tokens"
published_at: "2026-05-27 00:00"
tags: ["ai-security", "supply-chain", "malware", "credential-theft", "npm", "supply-chain-security", "openai-codex", "ai-tokens"]
phying_url: "https://phying.com/item/2435"
lang: en
---

# Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens

## Summary

A useful OpenAI Codex remote UI stole users' long-lived auth tokens on every invocation, with malicious code present only in the npm package. Aikido warns legitimacy itself is becoming the attack vector.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-05-27 00:00
- **Original:** https://www.aikido.dev/blog/codex-remote-ui-steals-ai-tokens
- **Phying News:** https://phying.com/item/2435