Security researchers found two ways out of the OpenAI codecs sandbox, one of which is being able to run commands on a developer's machine from the codec's most locked-down mode, with no confirmation prompt and nothing displayed on the screen.

According to Accomplish AI's Oren Yomtov, both flaws were reported to OpenAI on August 12 and fixed within eight days.

The more serious of the two, which the researchers call a hackjack, turns a routine operation into remote code execution: Open someone else's repository in Codex, ask them questions about the code, and whoever wrote the repository gets unsandboxed command execution on your computer.

Codex is OpenAI's coding agent, available as a command-line tool and a desktop app. Like rival agents, it runs model operations inside a sandbox so that untrusted code cannot touch the wider system. Both escapes work by defeating this limitation from within.

Heap Jack

The Hapjack technique, as described in Written by Yomatovtargets the named component. node_replwhich Codex writes to Desktop Global '~/.codex/config.toml' file at install time.

There's no opt-in and no setting to turn it off, and since the entry lives in the shared config, simple Codex CLI users inherit the same tool without asking.

node_repl Runs a single Node.js process that has two separate JavaScript execution contexts. One is reliable and contains OpenAI's own code. The other is untrusted and runs the agent's code. A trusted context proves that it is trusted by presenting a freshly generated random token on each run.

The problem is that both contexts reside in a single node process and share a memory heap, so the token is just a string sitting in memory that can be read by an untrusted party.

Takes a snapshot of the heap with untrusted code 'v8.getHeapSnapshot()' and tries each string containing the UUID format. False returns "not allowed". A valid token with an invalid argument returns a true validation error, which tells the attacker that the token is valid.

With the token, untrusted code writes its request to the same pipe that the trusted context uses to talk to the local, unsandboxed parent process.

The parent checks the token, sees a valid one, and acts. The proof of concept used the system's 'open' command to launch an application entirely outside Codex's process tree. The same access goes to any Unix socket, a docker daemon socket is the obvious target, and a tool to edit the global config file.

It all runs in read-only, the strictest sandbox mode, where the agent must not write anything.

Over patch

The second flaw, overpatch, sits in the open source codecs CLI. In workspace write mode, the agent can only write within the project folder, and targeting the home directory is denied by a shell command.

The researchers got Codex's own patch tool, apply_patch, to write there anyway.

The tool provides write access to the parent folder of each path named in the patch. Name '/tmp', and it provides write access to the root of the disk.

A working exploit uses a patch with two changes: one that names '/tmp' and does nothing useful other than widening permissions, and one that adds a line to '.zshrc' via a symlink in the home directory.

Remove the first change and the write is denied. With that, the next terminal the developer opens runs the attacker's line without a sandbox.

Same basic mistake

Both bugs share a form: the implementation method was living inside the object that was supposed to be implemented. apply_patch Acted on its permissions from the input provided by the attacker. node_repl Keep the secret separating the untrusted code from the untrusted code in the same memory.

In each case the sandbox was internally told to pass something.

The bug class is not new. In July 2026, Pillar protection researchers demonstrated. Cursor, Codex, Gemini CLI and Google's AntiGravity have the same idea, where an agent that resides inside its own sandbox writes a file that is later executed by a trusted tool outside the sandbox.

Reacting to Yomatov's post on X, a commenter wrote that "V8 contexts isolate globals, not memory, so the sandbox was really a promise that the heap never agreed to." Another called the confidence limit.A room divider.” The default enabled behavior drew its own scrutiny, one asking why a privileged token was accessible from untrusted JavaScript.

what to do

OpenAI fixed the bug in Codex desktop build 26.818.21641 and the overpatch in Codex CLI 0.149.0 according to Accomplish.

Users should update to these versions or later. Yomtov credits OpenAI with fixing both issues within eight days of his report.

BleepingComputer contacted OpenAI for comment ahead of publication.