Researchers escape OpenAI Codex sandbox to run commands on host (www.bleepingcomputer.com)

Security researchers have uncovered two critical vulnerabilities that allow escape from the OpenAI Codex sandbox, a protective environment designed to prevent untrusted code from accessing broader system resources. One of these vulnerabilities, dubbed "Heapjack," can execute commands on a developer's machine using Codex's most restrictive mode without prompting user approval or displaying warnings. This flaw enables attackers to exploit routine interactions with Codex—such as querying code from another repository—to gain unauthorized access to the system, making it a severe security threat. The technical implications are significant. Heapjack exploits a design flaw in the way Codex manages trusted and untrusted execution contexts within a single Node.js process. Both contexts share a memory heap, allowing the untrusted code to infer a validation token for the trusted context and perform actions outside the sandbox's intended limitations. Furthermore, the "Overpatch" vulnerability, present in the open-source Codex CLI, similarly compromises workspace-write mode, undermining the intended security measures. These discoveries highlight the need for ongoing vigilance and robust security practices in AI development environments, where the convergence of machine learning capabilities and software engineering can lead to unexpected vulnerabilities.