Researchers Break Out of OpenAI Codex Sandbox to Execute Host Commands

Post Views: 5

Security researchers identified critical flaws in OpenAI Codex that allowed unauthorized access to host systems, with one flaw enabling command execution in the most restrictive sandbox mode without user prompts or visual indicators.

Overview of the Vulnerabilities

Researchers uncovered two critical vulnerabilities in OpenAI Codex, a code generation tool designed to isolate untrusted code from the host system. Both issues were reported to OpenAI on August 12 and resolved within eight days, according to Oren Yomtov of Accomplish AI. The vulnerabilities bypassed the sandboxing mechanism, allowing attackers to execute arbitrary commands on a developer’s machine.

Heapjack Vulnerability

The more severe vulnerability, designated Heapjack, exploited a design flaw in Codex’s sandboxing architecture. It allowed attackers to execute arbitrary commands on a developer’s machine when a user opened a third-party code repository in Codex and queried the model about its contents. This triggered an unintended privilege escalation, bypassing the sandbox’s isolation mechanism.

Technical Details of Heapjack

The Heapjack attack targeted the node_repl module, which is automatically configured in the global ~/.codex/config.toml file during installation. This component runs a single Node.js process containing both trusted and untrusted JavaScript execution contexts. A randomly generated token, used to authenticate the trusted context, was stored in shared memory, allowing the untrusted code to access it via the v8.getHeapSnapshot() function. By scanning memory for UUID-shaped strings, the attacker could identify the valid token and use it to send requests through the same communication channel as the trusted context. This enabled the execution of system commands such as the open utility to launch external applications, access Unix sockets, or interact with Docker daemon interfaces.

Overpatch Vulnerability

A second vulnerability, Overpatch, affected the open-source Codex CLI. In workspace-write mode, the tool was designed to limit file modifications to the project directory. However, researchers demonstrated how the apply_patch utility could bypass these restrictions by leveraging a path-based permission flaw. By crafting a patch that referenced the /tmp directory, the exploit granted write access to the root file system. A subsequent patch modification appended a malicious command to the .zshrc file via a symlink, ensuring execution in future terminal sessions.

Architectural Flaws

Both vulnerabilities stemmed from a common architectural flaw: security enforcement mechanisms were implemented within the same process they were meant to restrict. The node_repl component’s token validation and the apply_patch utility’s permission checks relied on inputs that could be manipulated by untrusted code. This created a scenario where the sandbox itself facilitated the breach.

Security experts highlighted the fundamental design issue, noting that V8 JavaScript engine contexts isolate global variables but not memory spaces, rendering the sandbox a “promise the heap never agreed to.” The trust boundary was criticized as a “room divider” that failed to prevent internal exploitation.

Response and Recommendations

OpenAI addressed Heapjack in Codex Desktop version 26.818.21641 and Overpatch in CLI version 0.149.0. Users are advised to update to these versions or later. Yomtov acknowledged OpenAI’s rapid response, with both issues resolved within eight days of disclosure.

Conclusion

The findings underscore the challenges of securing AI-driven development tools, where traditional sandboxing techniques may not fully mitigate risks posed by complex, interconnected system components.