Researchers escape OpenAI Codex sandbox to run commands on host

Researchers found two OpenAI Codex sandbox escapes, including Heapjack, enabling unsandboxed command execution on developer machines; OpenAI fixed both within eight days.

Oren Yomtov of Accomplish AI reported two sandbox escapes in OpenAI Codex on August 12, fixed within eight days in Codex Desktop 26.818.21641 and Codex CLI 0.149.0. Heapjack targets the default-enabled node_repl component in Codex Desktop, whose trusted and untrusted JavaScript contexts share one Node.js memory heap, letting untrusted code dump the heap with v8.getHeapSnapshot(), brute-force the trusted context's UUID token, and issue unsandboxed commands in read-only mode, including reaching Unix sockets like the Docker daemon. Overpatch abuses the Codex CLI's apply_patch tool, which grants write access to parent directories of patch paths, so naming /tmp widens permissions enough to append a malicious line to .zshrc via a symlink into the home directory. Both attacks can trigger when a developer opens an attacker's repository and asks Codex about the code; no in-the-wild exploitation was reported.