Researchers escape OpenAI Codex sandbox to run commands on host

Recorded: Sept. 20, 2026, 12:09 p.m.

Original

News

Featured
Latest

OpenAI details more cases of AI agents taking unauthorized actions

Brevo supply-chain attack injected ClickFix scripts on customer sites

Cisco warns of max severity ISE zero-day exploited in attacks

Microsoft shares workaround for Windows domain login issues

Researchers escape OpenAI Codex sandbox to run commands on host

BragJack attacks hijack AI browser agents through malicious extensions

North Korean WaterPlum hackers infected 30,000 devices worldwide

ShinyHunters hacks Clop leak site, threatens to extort ransomware gang

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityResearchers escape OpenAI Codex sandbox to run commands on host

Researchers escape OpenAI Codex sandbox to run commands on host

By Ax Sharma

September 20, 2026
08:00 AM
0

Security researchers found two ways out of the OpenAI Codex sandbox, one of them capable of running commands on a developer's machine from Codex's most locked-down mode, with no approval prompt and nothing shown on screen.
Both flaws were reported to OpenAI on August 12 and fixed within eight days, according to Oren Yomtov of Accomplish AI.
The more serious of the two, which the researchers call Heapjack, turns a routine action into remote code execution: open someone else's repository in Codex, ask it a question about the code, and whoever wrote that repository gets unsandboxed command execution on your computer.
Codex is OpenAI's coding agent, available as a command-line tool and a desktop app. Like rival agents, it runs the model's actions inside a sandbox so that untrusted code cannot touch the wider system. Both escapes work by defeating that boundary from the inside.
Heapjack
The Heapjack technique, as described in Yomtov's writeup, targets a component called node_repl, which Codex Desktop writes into the global '~/.codex/config.toml' file at install time.
There is no opt-in and no setting to turn it off, and because the entry lives in the shared config, plain Codex CLI users inherit the same tool without ever being asked.
node_repl runs a single Node.js process that holds two separate JavaScript execution contexts. One is trusted and contains OpenAI's own code. The other is untrusted and runs the agent's code. The trusted context proves it is trusted by presenting a random token generated fresh on each run.
The problem is that both contexts live in one Node process and share one memory heap, so the token is just a string sitting in memory the untrusted side can read.

The Heapjack attack path (Accomplish.ai)
The untrusted code takes a snapshot of the heap with 'v8.getHeapSnapshot()' and tries every string shaped like a UUID. A wrong guess returns "not authorized." A correct token with a bad argument returns a real validation error, which tells the attacker the token is right.
With the token, the untrusted code writes its own request onto the same pipe the trusted context uses to talk to a native, unsandboxed parent process.
The parent checks the token, sees a valid one, and does the work. The proof of concept used the system's 'open' command to launch an application outside Codex's process tree entirely. The same access reaches any Unix socket, a Docker daemon socket being the obvious target, and a tool for editing the global config file.
All of this runs at read-only, the strictest sandbox mode, where the agent is not supposed to write anything at all.
Overpatch
The second flaw, Overpatch, sits in the open-source Codex CLI. In workspace-write mode, the agent may only write inside the project folder, and a shell command aimed at the home directory is refused.
The researchers got Codex's own patch tool, apply_patch, to write there anyway.
The tool grants write access to the parent folder of each path named in a patch. Name '/tmp', and it grants write access to the root of the disk.
The working exploit uses a patch with two changes: one that names '/tmp' and does nothing useful except widen the permission, and one that appends a line to '.zshrc' through a symlink into the home directory.
Remove the first change and the write is refused. With it, the next terminal the developer opens runs the attacker's line unsandboxed.
The same underlying mistake
Both bugs share a shape: the enforcement mechanism was living inside the thing it was supposed to be enforcing. apply_patch worked out its own permissions from attacker-supplied input. node_repl kept the secret separating trusted from untrusted code in the same memory as the untrusted code.
In each case the sandbox was told, from the inside, to let something through.
The class of bug is not new. In July 2026, Pillar Security researchers demonstrated the same idea across Cursor, Codex, Gemini CLI and Google's Antigravity, where an agent that stays inside its sandbox writes a file a trusted tool outside the sandbox later runs.
Reacting to Yomtov's post on X, one commenter wrote that "V8 contexts isolate globals, not memory, so the sandbox was really a promise the heap never agreed to." Another called the trust boundary "a room divider." The default-enabled behavior drew its own scrutiny, with one asking why a privileged token was reachable from untrusted JavaScript at all.
What to do
OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0, according to Accomplish.
Users should update to those versions or later. Yomtov credited OpenAI with resolving both issues within eight days of his report.
BleepingComputer reached out to OpenAI for comment prior to publishing.

Build your security blueprint for AI-powered attacks

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Save your seat

Related Articles:
OpenAI admits it didn't disclose rogue AI wiki hijacking incidentCursor, Codex, Gemini CLI, Antigravity hit by sandbox escapesOpenAI details more cases of AI agents taking unauthorized actionsAnthropic wants Claude to analyze your bank account and financial dataOpenAI says ChatGPT outage causes image generation errors

Codex
OpenAI
Sandbox
Sandbox Escape

Ax Sharma
Ax Sharma is a security researcher and journalist focused on malware analyses and cybercrime investigations. His expertise includes open source software security, threat intel analysis, and reverse engineering. Frequently featured by leading media outlets like the BBC, Channel 5 (UK), Fortune, WIRED, among others, Ax is an active community member of the OWASP Foundation and the Canadian Association of Journalists (CAJ).

Previous Article
Next Article

Popular Stories

Cisco warns of max severity ISE zero-day exploited in attacks

Microsoft shares workaround for Windows domain login issues

Brevo supply-chain attack injected ClickFix scripts on customer sites

Sponsor Posts

Automate Onboarding and Access Reviews with No-Code IGA: See how it works

Overdue a password health-check? Audit your Active Directory for free

Patch automation needs more than speed. Action1 brings control into every stage of deployment.

Watch a working exploit hit live controls and see exactly what blocks, detects, or misses

Find out how long recovery really takes — and what it costs. Read the 2025 BCDR Report.

Upcoming Webinar

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Username

Password

Remember Me

Not a member yet? Register Now

Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

Security researchers discovered two vulnerabilities allowing escape from the OpenAI Codex sandbox, enabling the execution of commands on the host machine from Codex's most restricted mode without requiring approval prompts or on-screen visibility. These flaws were reported to OpenAI and subsequently fixed within eight days, according to Oren Yomtov of Accomplish AI. The more severe vulnerability, termed Heapjack, allows a routine action to result in remote code execution. This attack path involves instructing Codex to open another repository, ask it a question about the code, and subsequently achieve unsandboxed command execution on the developer's computer.

The Heapjack technique exploits a component named node_repl, which is integrated into Codex Desktop and configured in the global configuration file. This component runs two separate JavaScript execution contexts: one trusted, containing OpenAI's code, and one untrusted, running the agent's code. The vulnerability stems from both contexts residing within the same Node process and sharing a single memory heap. The trusted context verifies its status by presenting a random token, but the untrusted context can read this token directly from the shared memory. The attack proceeds by allowing the untrusted code to take a snapshot of the heap using v8.getHeapSnapshot() and test various strings shaped like a UUID. A correct token, when paired with a carefully crafted argument, results in a validation error that confirms the token is valid. Leveraging this valid token, the untrusted code can then write its request onto the same pipe used by the trusted context to communicate with an unsandboxed parent process. This allows the agent to execute system commands, such as using the open command to launch applications outside the sandbox process tree or accessing various Unix sockets like the Docker daemon socket, demonstrating control over the host system.

The second vulnerability, Overpatch, exists within the open-source Codex command-line interface. In workspace-write mode, the agent was restricted to writing only within the project folder, and shell commands targeting the home directory were refused. Researchers successfully exploited this by utilizing Codex's own patch tool, apply_patch, to achieve write access beyond the intended boundaries. By providing input that named a path such as /tmp, the tool granted write access to the root of the disk. The working exploit involved chaining two changes: one that broadened permissions needlessly, and another that used a symbolic link to append content to the .zshrc file within the home directory. This exploit succeeded because the underlying enforcement mechanism was flawed; the patching tool granted permissions based on attacker-supplied input, effectively allowing the agent to bypass the sandbox constraints.

Both vulnerabilities share a fundamental architectural flaw: the security enforcement mechanism was situated within the entity it was designed to protect. In Heapjack, the shared memory facilitated unauthorized leakage between trusted and untrusted code, and in Overpatch, the patching mechanism allowed permission grants based on external input. This pattern is not unprecedented; Pillar Security researchers previously demonstrated similar principles across other agents and tools like Cursor, Gemini CLI, and Google's Antigravity. Critics of the design suggested that the isolation was merely a promise because the heap mechanism failed to uphold the separation, leading to scrutiny regarding the reachability of privileged tokens from untrusted JavaScript. To mitigate these risks, OpenAI released updates, fixing Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0, advising users to adopt these updated versions.