It’s trivial to prompt inject Codex. you just phrase it right. It’s been getting easier, not harder to attack because more parameters means more attack surface and for coding the attack surface is infinite.