Shipping Codex into Slack means every Zendesk ticket, calendar invite, and Confluence doc becomes an injection vector into an agent with write access to business systems. Anthropic already shipped this architecture with Claude Code, but OpenAI is rolling enterprise-wide before the indirect prompt injection mitigations are mature. Crypto ops teams running treasury workflows through Slack just picked up a new class of attack surface — and the incident will happen before the mitigation does.

Top comment by @Benthic