GoKawiilOpenAI Codex sandbox flaws let attackers execute code on developer machines
Security researchers at Accomplish AI discovered two ways to break out of the sandbox that isolates OpenAI's Codex coding agent from a user's system. The worse of the two, dubbed Heapjack, let a malicious repository trigger unsandboxed code execution on a victim's machine simply by having Codex answer a question about that repo's code, with no approval prompt or visible warning. Both bugs were reported to OpenAI on August 12 and patched within eight days.
GoKawiil's interpretation of the reporting above, not reported fact.
AI coding agents like Codex are designed to run untrusted code safely inside a sandbox, and this flaw shows that boundary can be silently defeated by exploiting shared memory between trusted and untrusted processes. Because the vulnerable component was installed automatically with no opt-out, even cautious users were exposed without knowing it, raising broader questions about how rigorously AI agent sandboxes are engineered against real attackers.
- Heapjack let a booby-trapped repo achieve remote code execution just by being opened in Codex.
- The flaw stemmed from trusted and untrusted code sharing one Node.js memory heap and a guessable auth token.
- OpenAI patched both sandbox escapes within eight days of the August 12 report.
Source: bleepingcomputer.com, 2026-09-20
Published there as: “Researchers escape OpenAI Codex sandbox to run commands on host”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.