The one we nearly cut
A Codex SDK point release wrote the prompt-injection boundary into one clause
OpenAI’s Codex Python SDK 0.154.0 adds ExternalMessage, a way for outside systems to speak into a running agent turn. Published at 19:51 UTC on 10 September, it also says what that speech is worth: “External content can start a turn or join an active regular turn with tool-level authority; it does not grant user authorization.” A webhook, a monitor or another agent can push text into a Codex session, and the SDK files it as a tool’s output rather than as an instruction from the person who started the session.
We nearly cut it as a point release of an SDK most readers do not use. We kept it because the three launches above all move tool-call decisions onto a vendor’s server, and this release writes down which inputs count as the user. It does not claim the model honours the label under hostile text; the label is a promise about routing, not about behaviour.
It also breaks hook code. HookMetadata now wraps its handler, so hook.command becomes hook.root.command.
What it changes If you feed webhook or agent output into Codex, move it onto ExternalMessage so it arrives with tool authority. Update any hook code that reads hook.command before upgrading.
Primary source read