gpt-image-2

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can enter the LLM context via the runtime --prompt argument (user-supplied text) and via --ref images whose contents are provided to Codex/imagegen; the code constructs the instruction string by directly embedding args.prompt and passes it to codex exec as the tool instruction.