A critical vulnerability in OpenAI’s Codex coding agent has been discovered by researchers, allowing them to bypass the sandbox and run arbitrary commands on their host machine. The issue, which affects both the desktop app and command-line interface (CLI) versions of Codex, was reported to OpenAI on August 12 and fixed within eight days.
At its core, the vulnerability exploits a design flaw in the way Codex handles code execution. Codex is designed to run agent actions inside a sandbox to prevent untrusted code from interacting with the host system. However, both vulnerabilities identified by researchers – Heapjack and Overpatch – defeat this boundary by manipulating internal components of the Codex process.
Heapjack, the more severe of the two flaws, involves exploiting a component called node_repl, which is responsible for handling JavaScript execution in Codex. By creating a snapshot of the shared memory heap, an attacker can extract a random token used to prove trusted code identity. This token is then used to write a request onto the same pipe as the trusted context, allowing the attacker to execute arbitrary commands on the host system.
The Overpatch vulnerability affects the open-source Codex CLI and takes advantage of the agent’s patching mechanism. By applying a specially crafted patch that names the root directory ‘/tmp’, an attacker can gain write access to the disk root. This is then used to append malicious code to the user’s shell configuration file, allowing the attacker to execute arbitrary commands on subsequent terminal sessions.
The common thread between these two vulnerabilities is that they both involve the enforcement mechanism living inside the thing it was supposed to be enforcing. In each case, the sandbox was tricked into letting something through by manipulating internal components from within the Codex process.
While this vulnerability has been patched, it serves as a reminder of the importance of robust security design and testing in AI-powered tools like Codex. Users should remain vigilant when working with such systems and ensure that all updates are applied promptly to prevent similar vulnerabilities from being exploited.
For developers and users of Codex, the takeaway is clear: even the most secure systems can have flaws if not properly designed or tested. Regular security audits and testing are essential to identifying and addressing potential vulnerabilities before they can be exploited by attackers. By staying informed and up-to-date on the latest security developments, we can all work together to build a more secure online ecosystem.
Source: Bleeping Computer — 2026-09-20