Two critical vulnerabilities in OpenAI Codex allowed attackers to bypass its sandboxing protections and execute arbitrary commands on a developer's machine, though both were patched within eight days of disclosure. Security researchers identified the flaws, which exploited fundamental design weaknesses in how the code generation tool isolates untrusted code from the host system.

What Are the Two Vulnerabilities That Broke Codex's Sandbox?

The first vulnerability, called Heapjack, was the more severe of the two. It allowed attackers to execute arbitrary commands on a developer's machine when a user opened a third-party code repository in Codex and queried the model about its contents. This triggered an unintended privilege escalation that completely bypassed the sandbox's isolation mechanism.

Heapjack targeted the node_repl module, which is automatically configured in the global ~/.codex/config.toml file during installation. This component runs a single Node.js process containing both trusted and untrusted JavaScript execution contexts. A randomly generated token, used to authenticate the trusted context, was stored in shared memory. The attacker could access this token via the v8.getHeapSnapshot() function, scan memory for UUID-shaped strings to identify the valid token, and then use it to send requests through the same communication channel as the trusted context. This enabled execution of system commands such as the open utility to launch external applications, access Unix sockets, or interact with Docker daemon interfaces.

The second vulnerability, called Overpatch, affected the open-source Codex CLI. In workspace-write mode, the tool was designed to limit file modifications to the project directory. However, researchers demonstrated how the apply_patch utility could bypass these restrictions by leveraging a path-based permission flaw. By crafting a patch that referenced the /tmp directory, the exploit granted write access to the root file system. A subsequent patch modification appended a malicious command to the.zshrc file via a symlink, ensuring execution in future terminal sessions.

Why Did These Flaws Exist in the First Place?

Both vulnerabilities stemmed from a common architectural flaw: security enforcement mechanisms were implemented within the same process they were meant to restrict. The node_repl component's token validation and the apply_patch utility's permission checks relied on inputs that could be manipulated by untrusted code. This created a scenario where the sandbox itself facilitated the breach.

Security experts highlighted the fundamental design issue, noting that the V8 JavaScript engine contexts isolate global variables but not memory spaces, rendering the sandbox a "promise the heap never agreed to." The trust boundary was criticized as a "room divider" that failed to prevent internal exploitation.

"Both issues were resolved within eight days of disclosure," noted Oren Yomtov of Accomplish AI, acknowledging OpenAI's rapid response to the security findings.

Oren Yomtov, Accomplish AI

How to Protect Yourself from These Codex Vulnerabilities

• Update Immediately: OpenAI addressed Heapjack in Codex Desktop version 26.818.21641 and Overpatch in CLI version 0.149.0. Users are advised to update to these versions or later to ensure they have the security patches.
• Verify Your Current Version: Check which version of Codex Desktop or CLI you are currently running before opening untrusted code repositories or using the workspace-write mode feature.
• Be Cautious with Third-Party Repositories: Avoid querying Codex about the contents of third-party code repositories until you have confirmed your software is fully patched, as this was the trigger for the Heapjack exploit.
• Review File Modification Permissions: If using the Codex CLI in workspace-write mode, understand that the tool was designed to limit modifications to the project directory, but verify this restriction is working as intended in your patched version.

The findings underscore the challenges of securing AI-driven development tools, where traditional sandboxing techniques may not fully mitigate risks posed by complex, interconnected system components. As developers increasingly rely on AI-powered code generation tools, the security of these systems becomes critical to protecting entire development environments from compromise.

Both vulnerabilities were reported to OpenAI on August 12 and resolved within eight days, demonstrating the company's commitment to addressing security issues quickly. However, the incident highlights the importance of developers staying vigilant about updating their tools and understanding the potential risks when working with AI-generated code.