Researchers Break Out of OpenAI Codex Sandbox to Execute Host Commands
Security researchers discover two methods to escape the OpenAI Codex sandbox, one of which runs commands on a developer's machine from the agent's most locked-down mode, triggering no approval prompt and displaying nothing on screen. Researcher Oren Yomtov of Accomplish AI reports both flaws to OpenAI on August 12, and the company fixes them within eight days.
The more serious flaw, which the researchers call Heapjack, turns a routine action into remote code execution. If a developer opens someone else's repository in Codex and asks a question about the code, the repository's author gains unsandboxed command execution on the developer's computer. The attack targets a component called node_repl, which Codex Desktop writes into a shared global config file at install time with no opt-in, meaning plain Codex CLI users inherit the same tool without being asked.
The node_repl component runs a single Node.js process holding a trusted context with OpenAI's code and an untrusted context with the agent's code. Because both contexts share one memory heap, the untrusted side snapshots the heap, guesses the trusted context's authentication token, and then writes its own requests onto the pipe the trusted context uses to communicate with an unsandboxed native parent process. The proof of concept launches an application outside Codex's process tree entirely, demonstrating full escape from the sandbox boundary.