Researchers escaped OpenAI's Codex sandbox to run silent commands on the host from its most restrictive mode

Security researchers at Accomplish AI found two ways out of the sandbox that OpenAI's Codex coding agent uses to keep untrusted code away from the rest of a developer's machine. The more serious one, which they call Heapjack, worked from Codex's most locked-down mode, showed no approval prompt, and displayed nothing on screen. Oren Yomtov of Accomplish AI said both flaws were reported to OpenAI on August 12 and fixed within eight days. Heapjack turned a routine action into remote code execution. A developer who opened someone else's repository in Codex and asked it a question about the code could give whoever wrote that repository unsandboxed command execution on the developer's computer. Codex is available as a command-line tool and a desktop app, and like rival agents it runs the model's actions inside a sandbox. Both escapes defeated that boundary from the inside. The technique targeted a component called node_repl. Codex Desktop writes it into the global Codex configuration file at install time, with no opt-in and no setting to turn it off. Because the entry lives in the shared configuration, plain Codex CLI users inherited the same tool without being asked. The component runs a single Node.js process that holds two separate JavaScript execution contexts, one of them trusted and containing OpenAI's own code. The finding matters because coding agents routinely open unfamiliar repositories, and the attack required nothing beyond that ordinary workflow.