Original sourcebleepingcomputer.com
Summary
Researchers demonstrated two separate vulnerabilities that escape Codex's strictest sandbox mode and execute commands on the host. The more severe one, Heapjack, abuses Codex Desktop's node_repl and the shared ~/.codex/config.toml configuration; simply opening someone else's repository and asking a…
Key points
- Developers using Codex Desktop or the CLI need to immediately confirm their version to avoid host-level code execution when opening someone else's repository.
- Once AI coding agents are given local execution privileges, a failed sandbox boundary is equivalent to handing the developer's machine over to the contents of an external repository.
- Development teams should upgrade to fixed versions and re-evaluate agent tool design around trust boundaries, shared config files, and patch tool permissions.
Editorial note
This page is Code & Chain's editorial summary of public sources. It may be prepared with AI assistance and published through an automated workflow. Refer to the original sources; this content is not investment, legal, or tax advice.