Security researchers found two ways to escape OpenAI’s Codex sandbox, including one that could run commands directly on a developer’s machine.
According to BleepingComputer, Accomplish AI researcher Oren Yomtov reported the flaws to OpenAI on 12 August, with the outfit fixing them within eight days. The more serious vulnerability was dubbed Heapjack.
Heapjack targeted a Codex Desktop component called node_repl, which is written into the global ~/.codex/config.toml file during installation. Codex CLI users could inherit it without being asked.
The component keeps trusted OpenAI code and untrusted agent code in separate JavaScript execution contexts. Unfortunately, both contexts live inside the same Node.js process and share the same memory heap.
The trusted context proves its identity with a randomly generated token, but that token sits in memory where untrusted code can hunt for it. Attackers could take a V8 heap snapshot and test strings resembling UUIDs until they found the right token.
Armed with the token, malicious code could send requests to the native unsandboxed parent process. Researchers demonstrated the attack using the system’s open command to launch an application outside Codex’s process tree.
Heapjack worked in read-only mode, Codex’s strictest sandbox setting. A developer could open a hostile repository, ask Codex about the code and end up handing the repository author unsandboxed command execution.
The second flaw, Overpatch, attacked the open-source Codex CLI’s workspace-write mode. Researchers persuaded Codex’s own apply_patch tool to write outside the supposedly permitted project directory.
By including /tmp in a patch, the tool granted write permission to the filesystem root. A second patch could then append malicious commands to .zshrc through a symbolic link, ready to execute when the developer opened another terminal.
Both bugs suffered from the same architectural headache: mechanisms enforcing the security boundary could be manipulated from inside it. OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0.
Users should update to those builds or later. Similar trust-boundary problems have already appeared across other AI coding agents, suggesting sandbox designers may want something sturdier than hoping the clever robot behaves itself.
