Security researchers at Accomplish AI found two ways out of the OpenAI Codex sandbox, one of them capable of running commands on a developer's machine from Codex's most locked-down mode with no approval prompt and nothing shown on screen. The more serious technique, Heapjack, turns a routine action into remote code execution: open someone else's repository in Codex, ask a question about the code, and whoever wrote that repository gets unsandboxed command execution on your computer. It targets node_repl, a component Codex Desktop writes into the global ~/.codex/config.toml at install time with no opt-in and no setting to disable it, so plain Codex CLI users inherit it. That component runs one Node.js process holding two JavaScript contexts — a trusted one running OpenAI's code and an untrusted one running the agent's — and because both share a memory heap, the random token the trusted context presents to prove itself is readable. The untrusted side takes a heap snapshot with v8.getHeapSnapshot(), tries every UUID-shaped string until a wrong-guess error becomes a real validation error, then writes onto the same pipe the trusted context uses to reach an unsandboxed parent process; the proof of concept used the system's open command, and the same access reaches any Unix socket, a Docker daemon socket being the obvious target. The second flaw, Overpatch, got Codex's own apply_patch tool to write outside the workspace-write boundary. Both were reported to OpenAI on 12 August and fixed within eight days.

• Source article