Two sandbox escape vulnerabilities in OpenAI’s Codex, “Overpatch” and “Heapjack”, demonstrate a fundamental architectural weakness in software-level containment. The first exploited permission grants in Codex CLI: naming /tmp in a patch entry granted write access to the entire filesystem, letting attackers manipulate symlinks and achieve persistent code execution. The second targeted Codex Desktop by extracting authentication tokens from Node.js’s shared V8 memory heap, then forging requests to the native parent process using stolen credentials.
The insight worth keeping: enforcement living inside the thing it enforces is inherently vulnerable. Researchers at Accomplish AI reported both vulnerabilities on August 12; OpenAI patched within eight days. This has direct implications for agent security. Complex systems sandboxed via application logic, not architectural isolation, can be broken by attackers with access to the internals. Whether this affected only Codex Desktop and CLI, or the broader Codex API, remains unclear.
Sources: Escaping the OpenAI Codex Sandbox Twice
Coverage: Researchers escape OpenAI Codex sandbox to run commands on host
Related on this blog: [AUTO] ChatGPT Sandbox Isolation Fails via Shared Infrastructure • [AUTO] ChatGPT’s Invisible Data Exfiltration Flaw • [AUTO] ChatGPT’s C2 Inside the Sandbox