AIKIDO-2026-732106

TL;DR

On Windows, Codex decides whether a shell command is read-only enough to run without extra approval by parsing PowerShell scripts and lowering only the end-block statements into command words that it checks against a safelist. Parameter defaults, named blocks such as begin and process, using preambles, and top-level trap handlers are not represented in that lowered list, so executable code placed in those regions is never inspected. An attacker who can influence a proposed command can hide side-effecting statements in those uninspected regions so a destructive script is classified as safe and auto-approved without user confirmation. The fix makes the classifier fail closed by rejecting any PowerShell script that contains these uninspected AST regions.