Researchers report two escapes from OpenAI Codex sandbox

Security researchers reported two ways to escape the OpenAI Codex sandbox, including one that could run commands on a developer’s machine from Codex’s most locked-down mode without an approval prompt or visible activity.

According to Oren Yomtov of Accomplish AI, both flaws were reported to OpenAI on August 12 and fixed within eight days. The more serious flaw, called Heapjack, targets node_repl, which Codex Desktop writes to the global ~/.codex/config.toml file. Researchers said untrusted JavaScript could read a trusted token from the shared Node.js process memory, then use it to send requests to an unsandboxed parent process.

A proof of concept used the system’s open command to launch an application outside Codex’s process tree. The same access could reach Unix sockets, including a Docker daemon socket, according to the researchers.

The second flaw, Overpatch, affected the open-source Codex CLI in workspace-write mode. Researchers said apply_patch could be given a patch that widened its write permissions and appended a line to .zshrc through a symlink. Accomplish said OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0. BleepingComputer said it contacted OpenAI for comment.