GoKawiilSecurity researchers found two ways out of the OpenAI Codex sandbox, one of them capable of running commands on a developer's machine from Codex's most locked-down mode, with no approval prompt and nothing shown on screen.
Both flaws were reported to OpenAI on August 12 and fixed within eight days, according to Oren Yomtov of Accomplish AI.
The more serious of the two, which the researchers call Heapjack, turns a routine action into remote code execution: open someone else's repository in Codex, ask it a question about the code, and whoever wrote that repository gets unsandboxed command execution on your computer.
Codex is OpenAI's coding agent, available as a command-line tool and a desktop app. Like rival agents, it runs the model's actions inside a sandbox so that untrusted code cannot touch the wider system. Both escapes work by defeating that boundary from the inside.
Heapjack
The Heapjack technique, as described in Yomtov's writeup, targets a component called node_repl, which Codex Desktop writes into the global '~/.codex/config.toml' file at install time.
There is no opt-in and no setting to turn it off, and because the entry lives in the shared config, plain Codex CLI users inherit the same tool without ever being asked.
node_repl runs a single Node.js process that holds two separate JavaScript execution contexts. One is trusted and contains OpenAI's own code. The other is untrusted and runs the agent's code. The trusted context proves it is trusted by presenting a random token generated fresh on each run.
The problem is that both contexts live in one Node process and share one memory heap, so the token is just a string sitting in memory the untrusted side can read.
The Heapjack attack path (Accomplish.ai)
... continue reading