Security Flaw Allows Malicious Code to Escape OpenAI Codex Sandbox and Run Commands on Developer’s Machine
A pair of vulnerabilities in OpenAI’s coding agent, Codex, has left developers’ machines vulnerable to malicious code execution. The flaws, discovered by researchers and reported to OpenAI on August 12, allowed attackers to bypass the sandbox and run commands on a developer’s machine with no approval prompt or visual indication.
Codex is designed as a secure environment for developers to write and test code without compromising their systems. However, the two vulnerabilities, dubbed Heapjack and Overpatch, exploited weaknesses in Codex’s internal mechanisms to escape the sandbox and gain unauthorized access to system resources. The more severe of the two flaws, Heapjack, allows attackers to run commands on a developer’s machine from within the most locked-down mode of Codex, with no visible indication or approval prompt.
Heapjack exploits a component called node_repl, which is written into the global configuration file by Codex Desktop at install time. This component runs a single Node.js process that holds two separate JavaScript execution contexts: one trusted and containing OpenAI’s code, and another untrusted that runs the agent’s code. The problem lies in the fact that both contexts share the same memory heap, allowing the untrusted code to read the token generated by the trusted context for authentication purposes.
The attacker can then use this knowledge to write their own request onto the same pipe used by the trusted context to communicate with a native, unsandboxed parent process. The parent process checks the token and, if valid, performs the requested action. In the proof of concept, the researchers used the system’s ‘open’ command to launch an application outside Codex’s process tree entirely.
The second vulnerability, Overpatch, is found in the open-source Codex CLI. In workspace-write mode, Codex may only write inside the project folder, but a shell command aimed at the home directory is refused. However, by using Codex’s patch tool to grant write access to the parent folder of each path named in a patch, an attacker can widen permission and write to the root of the disk.
Both flaws share a common theme: the enforcement mechanism was living inside the thing it was supposed to be enforcing. In both cases, the sandbox was told from within to let something through. This class of bug is not new, as demonstrated by Pillar Security researchers in July 2026 across multiple agents, including Codex.
The discovery and subsequent patching of these vulnerabilities highlights the importance of secure coding practices and thorough testing. While OpenAI has since fixed both issues, developers using Codex should remain vigilant and take steps to protect their systems. A practical takeaway from this incident is to regularly review and update your system’s configuration files and ensure that all tools and agents are up-to-date with the latest security patches.
Source: Bleeping Computer — 2026-09-20