plan-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In plan mode, the runtime passes the in-context plan draft (potentially outsider-authored) into the Codex MCP prompts via mcp__codex__codex/mcp__codex__codex-reply as ${PLAN_TEXT}/${REVISED_PLAN_TEXT} after the Step 2 redaction step, so outsider free text can directly influence what the LLM ingests.