OpenAI Codex Sandbox Flaws Allow Silent Command Execution

Security researchers have identified two distinct ways to bypass the security sandbox in OpenAI's Codex coding agent. One of these flaws was severe enough to allow remote code execution on a developer's machine while operating in the tool's most restrictive mode, without triggering any approval prompts or visual warnings on the screen.

Both vulnerabilities were reported to OpenAI on August 12 and were patched within eight days, according to Oren Yomtov of Accomplish AI. The incident highlights a critical weakness in how AI coding agents are designed to isolate untrusted code from the host system, a boundary that proved fragile in practice.

Heapjack turns routine actions into exploits

The more dangerous flaw, dubbed Heapjack, exploits a component in Codex Desktop known as node_repl. This tool runs a single Node.js process containing two separate JavaScript contexts: one trusted for OpenAI's internal code and one untrusted for the agent's actions. The trusted context authenticates itself using a random token generated at runtime.

The critical error lies in the fact that both contexts share the same memory heap. This means the untrusted code can access the memory where the secret token is stored. By taking a snapshot of the heap and scanning for strings that match a UUID format, an attacker can identify the correct token. Once obtained, this token allows the untrusted code to send requests to a native, unsandboxed parent process, effectively gaining full control over the system.

This attack works even in read-only mode, the strictest setting where the agent should not be able to write anything. The proof of concept used the system's open command to launch applications outside Codex's process tree. As reported by BleepingComputer, this access could also reach sensitive Unix sockets, such as the Docker daemon, allowing for significant system compromise.

Overpatch bypasses file write restrictions

The second vulnerability, named Overpatch, affects the open-source Codex CLI. In workspace-write mode, the agent is restricted to writing files only within the project folder. However, researchers found a way to use the built-in apply_patch tool to write to the user's home directory, which is normally protected.

The exploit works by manipulating how the patch tool calculates permissions. The tool grants write access to the parent folder of any path included in a patch. By including a harmless path like /tmp in a patch, the tool inadvertently grants write access to the root of the disk. A second change in the same patch can then append malicious code to configuration files like .zshrc via a symbolic link.

Shared flaw in sandbox enforcement logic

Both bugs stem from a common design mistake: the enforcement mechanism was living inside the component it was supposed to be restricting. In the case of Heapjack, the secret token separating trusted from untrusted code was stored in the same memory space as the untrusted code. In Overpatch, the permission logic was based on input that the attacker could manipulate.

This class of vulnerability is not new. Similar issues have been demonstrated in other AI coding tools, where agents that remain inside their sandboxes can manipulate trusted tools outside to perform unauthorized actions. The incident underscores the difficulty of creating secure boundaries for AI agents that must interact with complex system environments.