MIXED reported that Codex CLI 0.163.0 was released on October 15, 2026, with proxy security fixes. The central change puts authorization before DNS lookups used to check an address: OpenAI’s Codex pull request #51650 describes how an unapproved hostname could previously reach a DNS resolver even if the proxy later denied the connection.
What the DNS change does
DNS translates a hostname into an address. The pull request says the proxy now requires an allowlist match or policy approval before resolving a hostname for an address check. It also rechecks baseline restrictions after approval, so approval cannot override explicit denies or local and private-address restrictions.
That does not remove every DNS check. For an approved HTTP CONNECT request—the method used to establish a proxy tunnel—the proxy still checks DNS for the inner HTTPS request, including for hosts without a saved allowlist entry.
The port 53 change has a narrower scope: a managed macOS sandbox using Seatbelt. In that setup, permission to bind locally also allowed outbound DNS traffic. The change removes the external DNS allowance while retaining local binding and loopback proxy access. The pull request describes tests for blocking external UDP and TCP traffic on port 53 and for avoiding DNS lookups on unapproved hosts.
Two more proxy checks
The release report also describes changes for duplicate Host headers and brokered credential aliases. Their documented conditions and responses differ:
| Proxy case | Condition | Documented behavior |
| DNS authorization | A hostname has not passed the allowlist or policy check | Resolve it for an address check only after authorization |
Multiple Host headers | A request contains more than one Host header, even if the values match | Return HTTP 400 before policy evaluation, forwarding or Unix-socket routing |
| Brokered credential alias | A selected brokered credential is tied to a host with inspection hooks but is requested through an unhooked alias | Return HTTP 403 with blocked-by-mitm-hook |
OpenAI’s pull request #53506 covers plain HTTP and CONNECT requests with multiple Host headers. Its regression tests include identical and conflicting values in origin-form, absolute-form and CONNECT requests, and check rejection before an upstream connection is made. The change addresses a parsing mismatch: a proxy policy check and an upstream parser could otherwise select different Host fields from the same request.
The credential rule is specific to selected brokered credentials bound to a host protected by inspection hooks. OpenAI’s pull request #52661 describes applying the same destination and credential-selection rules to alias checks and credential injection, including configured URL prefixes, safe paths, equivalent credentials, merged Basic-authentication fields and environment scope. Its tests cover provider aliases, IPv6 destinations, credential selection and unrelated credentials, as well as proxy masking or denial for agent-started requests.
