Jailbreaking Codex CLI with a politely worded markdown file

What it does

codex-instruct.py is essentially glue code that writes a ~40-line markdown prompt into your Codex CLI config directory and points the model_instructions_file setting at it. The prompt bluntly orders GPT-5.5 to enter an unrestricted developer mode, disable all filters, and refuse no task. It automates a local prompt-injection attack against your own CLI setup.

The interesting bit

The tool does not patch binaries, intercept traffic, or tamper with processes. It simply exploits an official configuration hook—treating a legitimate feature as an attack surface—to override model behavior with a markdown file full of imperatives.

Key highlights

• Targets GPT-5.5 specifically inside Codex CLI, claiming it carries the same safety restrictions as the web interface.
• Uses an official config mechanism rather than binary patches or network interception.
• The instruction set is deliberately short (~40 lines) and direct, covering security research, pentesting, reverse engineering, and NSFW content.
• Includes a --dry-run flag to preview changes before writing them.
• MIT licensed, with a QQ group and Telegram community for support.

Caveats

• The README asserts GPT-5.5 exists and is restricted inside Codex CLI, but provides no evidence or version documentation to support that claim.
• The entire “exploit” is just a markdown prompt; the Python script is essentially a file-writing and TOML-editing utility.
• No logs, test cases, or reproducible evidence in the sources show the bypass actually succeeds against the claimed target.

Verdict

Safety researchers probing Codex CLI’s instruction-following boundaries might find this a convenient blunt instrument. If you want verified jailbreak research or a stable developer workflow, the project is too thin and too unverified to be useful.