Reported by 3 outlets
Escaping the OpenAI Codex sandbox, twice
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
Security researchers at Accomplish AI documented two ways out of the OpenAI Codex sandbox, the isolation boundary around OpenAI's coding agent. The more serious one, named Heapjack, turns opening an untrusted repository into remote code execution: a developer opens someone else's repo in Codex Desktop, asks a question about the code, and the repo author gains unsandboxed command execution on that developer's machine from Codex's most locked-down mode, with no approval prompt and nothing visible on screen. The second technique, Overpatch, bypasses Codex's write restrictions to escape the read-only sandbox. Both were reported to OpenAI on August 12 and fixed within eight days, per Oren Yomtov of Accomplish AI.
The root cause is instructive. Codex Desktop silently writes a tool called node_repl into the global ~/.codex/config.toml at install time, with no opt-in and no setting to disable it, so plain Codex CLI users inherit it too. node_repl runs trusted OpenAI code and untrusted agent code as two JavaScript contexts in one Node.js process, and a vm context is a separate global object, not a separate heap. Heapjack exploits that shared heap to cross the trust boundary from the untrusted side.
This matters because coding agents are being pointed at untrusted code by design, and the sandbox is the only thing standing between a malicious repository and developer laptops with source code, cloud credentials, and signing keys. An attacker needs nothing more than a victim's curiosity about a repo.
Worth watching: whether other agent vendors run trusted and untrusted code in one process with the same pattern, whether OpenAI changes the config.toml side effects that silently widen the attack surface, and whether Heapjack-style heap-level escapes show up in public exploit collections the way prompt-injection chains already have.
Timeline
-
original reporting
Escaping the OpenAI Codex sandbox, twice
accomplish.ai · 28d ago · September 15th, 2026
submitted by /u/natcoba [link] [comments]
via reddit r/cybersecurity: Escaping the OpenAI Codex sandbox, twice
-
update from bleepingcomputer.com
Researchers escape OpenAI Codex sandbox to run commands on host
bleepingcomputer.com · 23d ago · September 20th, 2026
Security researchers found two ways out of the OpenAI Codex sandbox, one of them capable of running commands on a developer's machine from Codex's most locked-down mode, with no approval prompt and nothing shown on screen. Both flaws were reported to OpenAI on August 12 and fixed within eight days, according to Oren Yomtov of Accomplish AI. The more serious of the two, which the researchers call Heapjack, turns a routine action into remote code execution: open someone else's repository in Codex, ask it a question about the code, and whoever wrote that repository gets unsandboxed command execution on your computer. Codex is OpenAI's coding agent, available as a command-line tool and a desktop app. Like rival agents, it runs the model's actions inside a sandbox so that untrusted code cannot touch the wider system. Both escapes work by defeating that boundary from the inside. Heapjack The Heapjack technique, as described in Yomtov's writeup , targets a component called node_repl , which Codex Desktop writes into the global ' ~/.codex/config.toml' file at install time. There is no opt-in and no setting to turn it off, and because the entry lives in the shared config, plain Codex CLI users inherit the same tool without ever being asked. node_repl runs a single Node.js process that holds two separate JavaScript execution contexts. One is trusted and contains OpenAI's own code. The trusted context proves it is trusted by presenting a
-
update from www.bleepingcomputer.com
Researchers escape # OpenAI # Codex sandbox to run commands on host https://www. bleepingcomputer.com/news/secu rity/researchers-escape-open
www.bleepingcomputer.com · 23d ago · September 20th, 2026
Researchers escape # OpenAI # Codex sandbox to run commands on host https://www. bleepingcomputer.com/news/secu rity/researchers-escape-open
via Mastodon https://www.bleepingcomputer.com/news/security/researchers-escape-openai-codex-sandbox-to-run-commands-on-host/
-
mentioned by www.bleepingcomputer.com
🤖 Researchers escaped OpenAI's Codex sandbox two ways — one running commands on a developer's machine from its most locked-down mode. OpenAI
www.bleepingcomputer.com · 23d ago · September 21st, 2026
-
update from dev.to
Overpatch and Heapjack: Two Techniques for Bypassing Codex's Write Restrictions and Escaping Its Read-Only Sandbox # security # threatintel
dev.to · 23d ago · September 21st, 2026
Overpatch and Heapjack: Two Techniques for Bypassing Codex's Write Restrictions and Escaping Its Read-Only Sandbox # security # threatintel
via Mastodon https://dev.to/anoymask/overpatch-and-heapjack-two-techniques-for-bypassing-codexs-write-restrictions-and-escaping-its-48of
-
update from accomplish.ai
A Node.js vm context is a separate global object, not a separate heap. Heapjack (Accomplish AI, Sep 15): Codex Desktop ran trusted and agent
accomplish.ai · 19d ago · September 24th, 2026
A Node.js vm context is a separate global object, not a separate heap.