Codex built a credential broker into its network proxy so the agent's shell never holds a real secret

GitHub·high signalXBlueskyLinkedInCopy link

A cluster of PRs merged into openai/codex on 2026-09-09 adds `credential_providers` config: the proxy hands the sandboxed process generated dummy credentials and substitutes the real ones at the wire, restricted to authorized schemes, hosts, ports and path prefixes, with credentials and destination history scoped per environment (#44056). #44089 extends the substitution into plaintext HTTP inside CONNECT and SOCKS5 tunnels, where interception previously only handled TLS, and rejects mismatched authorities and nested CONNECT. Snapshot redaction and alias matching (#44040, #44038, #44066) keep the dummies out of replayed shell snapshots. This is a different mechanism from the Touch ID gate shipped a day earlier: that authorizes a call, this one removes the secret from the agent's reach entirely.