Code & Chain · Signal Desk

Researchers Bypass OpenAI Codex Sandbox to Execute Commands on Host

Original sourcebleepingcomputer.com

Summary

Researchers demonstrated two separate vulnerabilities that escape Codex's strictest sandbox mode and execute commands on the host. The more severe one, Heapjack, abuses Codex Desktop's node_repl and the shared ~/.codex/config.toml configuration; simply opening someone else's repository and asking a…

Key points

  • Developers using Codex Desktop or the CLI need to immediately confirm their version to avoid host-level code execution when opening someone else's repository.
  • Once AI coding agents are given local execution privileges, a failed sandbox boundary is equivalent to handing the developer's machine over to the contents of an external repository.
  • Development teams should upgrade to fixed versions and re-evaluate agent tool design around trust boundaries, shared config files, and patch tool permissions.

Editorial note

This page is Code & Chain's editorial summary of public sources. It may be prepared with AI assistance and published through an automated workflow. Refer to the original sources; this content is not investment, legal, or tax advice.