Scientists leave OpenAI Codex sandbox to run commands on host

Security scientists discovered 2 escapes of the OpenAI Codex sandbox, among them efficient in running commands on a designer’s maker from Codex’s the majority of locked-down mode, without any approval timely and absolutely nothing revealed on screen.

Both defects were reported to OpenAI on August 12 and repaired within 8 days, according to Oren Yomtov of Accomplish AI.

The more major of the 2, which the scientists call Heapjack, turns a regular action into remote code execution: open another person’s repository in Codex, ask it a concern about the code, and whoever composed that repository gets unsandboxed command execution on your computer system.

Codex is OpenAI’s coding representative, offered as a command-line tool and a desktop app. Like competing representatives, it runs the design’s actions inside a sandbox so that untrusted code can not touch the larger system. Both gets away work by beating that limit from the within.

Boxing Heapjack

The Heapjack strategy, as explained in Yomtov’s writeuptargets a part called node_replwhich Codex Desktop composes into the worldwide’~/. codex/config. toml’file at set up time.

There is no opt-in and no setting to turn it off, and since the entry resides in the shared config, plain Codex CLI users acquire the very same tool without ever being asked.

node_repl runs a single Node.js procedure that holds 2 different JavaScript execution contexts. One is relied on and consists of OpenAI’s own code. The other is untrusted and runs the representative’s code. The relied on context shows it is relied on by providing a random token created fresh on each run.

The issue is that both contexts reside in one Node procedure and share one memory stack, so the token is simply a string being in memory the untrusted side can check out.

The untrusted code takes a photo of the stack with’v8.getHeapSnapshot ()’and attempts every string formed like a UUID. An incorrect guess returns “not authorized.” A proper token with a bad argument returns a genuine recognition mistake, which informs the aggressor the token is.

With the token, the untrusted code composes its own demand onto the exact same pipeline the relied on context utilizes to speak to a native, unsandboxed moms and dad procedure.

The moms and dad checks the token, sees a legitimate one, and does the work. The evidence of idea utilized the system’s ‘open’ command to introduce an application outside Codex’s procedure tree totally. The very same gain access to reaches any Unix socket, a Docker daemon socket being the apparent target, and a tool for modifying the worldwide config file.

All of this performs at read-only, the strictest sandbox mode, where the representative is not expected to compose anything.

Boxing Overpatch

The 2nd defect, Overpatch, beings in the open-source Codex CLI. In workspace-write mode, the representative might just compose inside the job folder, and a shell command targeted at the home directory site is declined.

The scientists got Codex’s own spot tool, apply_patch, to compose there anyhow.

The tool grants compose access to the moms and dad folder of each course called in a spot. Call ‘/ tmp’, and it gives compose access to the root of the disk.

The working make use of utilizes a spot with 2 modifications: one that names ‘/ tmp’ and not does anything helpful other than broaden the authorization, and one that adds a line to ‘. zshrc’ through a symlink into the home directory site.

Get rid of the very first modification and the compose is declined. With it, the next terminal the designer opens runs the opponent’s line unsandboxed.

Boxing The exact same underlying error

Both bugs share a shape: the enforcement system was living inside the important things it was expected to be implementing. apply_patch exercised its own consents from attacker-supplied input. node_repl kept the secret separating relied on from untrusted code in the very same memory as the untrusted code.

In each case the sandbox was informed, from the within, to let something through.

The class of bug is not brand-new. In July 2026, Pillar Security scientists showed the exact same concept throughout Cursor, Codex, Gemini CLI and Google’s Antigravity, where a representative that remains inside its sandbox composes a file a relied on tool outside the sandbox later on runs.

Responding to Yomtov’s post on X, one commenter composed that “V8 contexts isolate globals, not memory, so the sandbox was really a promise the heap never agreed to.” Another called the trust limit “ a space divider” The default-enabled habits drew its own examination, with one asking why a fortunate token was obtainable from untrusted JavaScript at all.

Boxing What to do

OpenAI repaired Heapjack in Codex Desktop construct 26.818.21641 and Overpatch in Codex CLI 0.149.0, according to Accomplish.

Users ought to upgrade to those variations or later on. Yomtov credited OpenAI with dealing with both concerns within 8 days of his report.

BleepingComputer connected to OpenAI for remark prior to publishing.

Boxing

Construct your security plan for AI-powered attacks

Sign Up With Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital top on what AI-speed attacks alter, what protectors need to stop doing, and how to confirm, choose, repair, and re-validate at device speed.

Conserve your seat