Codex key abuse after opening Codex

Quick fix

The original report only describes suspected abnormal calls; no verifiable fix or virus file location was provided.

Symptom

Error outputCopy

一旦设置好key，打开codex过一两分钟就开始盗刷了

English translation

After setting a key, opening codex leads to unauthorized charges within one or two minutes.

Cause

The report states that after using cc-switch 3.13.0 on Windows, setting a key and opening Codex led to gpt-5.4 calls not initiated by the user and unusual quota consumption within minutes. Another commenter reported similar quota anomalies, with one mentioning CC-Switch-v3.16.1-Windows-Portable.

The original post and comments provide no reproducible evidence, confirmed root cause, malicious file location, or verified fix. The maintainer only stated that the software is open source and built through GitHub Actions. Therefore, this does not confirm credential leakage or a backdoor in any specific version.

Fix

1. 1

   The original post does not provide a verifiable fix. Keep relevant usage records and follow the maintainer's investigation in the source issue.

Affected Versions

ToolCodex

VersionUnknown

PlatformsWindows

Source Issues

This page is distilled from 1 real issues

• #21943.13.0版本疑似有病毒

FAQ

How can I find the location of the virus file?

This issue does not provide a confirmed file location or investigation result.

Related problems

Session expired: Codex OAuth session expiredUpgrade to cc-switch v4.0.0 or later to prevent old snapshots from overwriting new login credentials.2 issues mergedOfficial account balance information suddenly missing in CodexUpgrade to the latest version, which reworked quota display in 4.0, and check again. If it is still missing, provide the version, login method, plan type…3 issues mergedCodex usage statistics failureAfter Codex updated to 26.917.51856, GPT-6 Sol usage statistics may remain at 0; the issue provides no confirmed fix.1 issues merged