Meta News

Security researchers discovered two vulnerabilities that allowed them to escape the sandbox used by OpenAI’s Codex coding agent, including one technique capable of executing commands directly on a developer’s computer even when Codex was operating in its most restrictive mode.

The flaws, dubbed Heapjack and Overpatch, were reported to OpenAI on August 12 by researchers at Accomplish AI. OpenAI fixed both issues within eight days.

The findings highlight an increasingly important security problem surrounding AI coding agents. These tools can inspect repositories, execute commands, modify files and interact with development environments, making the sandbox separating agent-controlled code from the host operating system a critical security boundary.

The more serious vulnerability, Heapjack, targeted a Codex component callednode_repl.

The component maintained two JavaScript execution contexts inside the same Node.js process. One contained trusted OpenAI code, while the other executed untrusted code controlled by the agent.

A randomly generated token was supposed to distinguish the trusted environment from the untrusted one. However, both contexts shared the same memory heap.

Researchers discovered that untrusted code could take a V8 heap snapshot, search memory for strings matching the token’s format, and determine which candidate was correct based on differences in error responses.

Once the token was recovered, malicious code could send requests through the communication channel used by the trusted process.

The researchers demonstrated that this could reach an unsandboxed parent process and execute actions on the underlying operating system. Their proof of concept launched an application using the system’sopencommand.

More concerningly, the technique worked even when Codex was running in read-only mode, its strictest sandbox configuration.

The attack scenario makes Heapjack particularly significant.

A developer could open someone else’s repository in Codex and simply ask the agent a question about the code. Malicious content inside that repository could then potentially influence the agent into triggering the sandbox escape.

This creates a security problem similar to indirect prompt injection, but with consequences extending beyond the AI conversation itself.

If the sandbox boundary fails, untrusted repository content could potentially influence actions on the developer’s actual machine.

The same access could also potentially reach Unix sockets, including powerful resources such as a Docker daemon socket.

The second vulnerability, Overpatch, affected the open-source Codex CLI.

Inworkspace-writemode, Codex is supposed to modify files only inside the project’s directory. Commands attempting to write elsewhere should be blocked.

Researchers found that Codex’s ownapply_patchtool could unintentionally expand those permissions.

By including/tmpin a specially constructed patch, the tool granted write access to the parent directory — effectively the filesystem root. The researchers then used a symbolic link to modify.zshrcinside the developer’s home directory.

The next time the developer opened a terminal, the injected command would execute outside the Codex sandbox.

Although Heapjack and Overpatch exploited different components, researchers identified a common architectural weakness.

In both cases,part of the security enforcement existed inside the environment it was supposed to restrict.

Overpatch allowed attacker-controlled patch information to influence filesystem permissions. Heapjack stored the secret separating trusted and untrusted execution inside memory accessible to both environments.

This illustrates a broader security principle for agentic systems: security boundaries should ideally be enforced outside the environment controlled by the agent.

As coding agents become more autonomous, they increasingly process untrusted repositories, documentation, configuration files and issue descriptions while simultaneously possessing powerful tools capable of interacting with developers’ computers.

A failure in the sandbox can therefore turn malicious project content into host-level code execution.

OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0. Users should upgrade to those versions or later.

The vulnerabilities were resolved quickly after disclosure, but they demonstrate why sandboxing has become one of the most important security components of AI development tools.

The danger is no longer limited to an AI agent generating incorrect code. An agent may be simultaneously reading untrusted information and operating tools with access to a developer environment.

That makes the sandbox one of the boundaries separating malicious instructions inside a repository from commands executing on the developer’s actual machine.