Researchers escape OpenAI Codex sandbox to run commands on host

Security researchers found two ways out of the OpenAI Codex sandbox. One, called Heapjack, could run commands on a developer’s machine from Codex’s most restricted mode without an approval prompt or anything shown on screen. The second flaw, Overpatch, allowed the Codex CLI to write outside the project folder in workspace-write mode. OpenAI fixed both flaws within eight days of being notified.