Codex sandbox bypass lets attackers execute code on developer machines
Security researchers discovered two vulnerabilities in OpenAI's Codex coding agent that allow escaping its sandbox, with one flaw enabling remote code execution on a developer's machine without any approval prompt. The more severe issue, dubbed Heapjack, exploits a shared memory heap between trusted and untrusted JavaScript contexts to steal a validation token and issue commands to an unsandboxed parent process. OpenAI patched both flaws within eight days of the August 12 report.
Heapjack exploits node_repl's shared memory heap, where untrusted code can snapshot memory, extract a UUID validation token, and send commands to an unsandboxed parent process—all in read-only mode. Overpatch abuses apply_patch's permission logic: naming '/tmp' in a patch grants root-level write access, letting a symlinked .zshrc modification execute on next terminal launch. OpenAI patched both within eight days of the August 12 report.
This could affect developers who open unfamiliar repositories in Codex, potentially granting remote attackers unsandboxed command execution on their machines. The read-only mode bypass is particularly concerning since it defeats the strictest security setting. While OpenAI responded quickly, the underlying pattern—enforcement living inside the thing being enforced—may persist in other AI coding tools, suggesting broader industry implications for sandbox design.