Security researchers found two ways to escape the OpenAI Codex sandbox, one capable of running commands on a developer's machine from Codex's most locked-down mode with no approval prompt and nothing shown on screen, according to Oren Yomtov of Accomplish AI. Both flaws were reported to OpenAI on August 12 and fixed within eight days. The more serious flaw, called Heapjack, turns opening someone else's repository in Codex and asking a question about the code into unsandboxed command execution by the repository's author on the user's computer. It targets node_repl, which Codex Desktop writes into the global '~/.codex/config.toml' file at install time, with no opt-in and no setting to turn it off, so plain Codex CLI users inherit the same tool. node_repl runs a single Node.js process holding trusted and untrusted JavaScript contexts that share one memory heap, letting untrusted code read the trusted context's random token via 'v8.getHeapSnapshot()', then write requests onto the trusted context's pipe to an unsandboxed parent process. The proof of concept used the system's 'open' command, and the same access reaches any Unix socket, including a Docker daemon socket, and a tool for editing the global config file, all at read-only mode. The second flaw, Overpatch, sits in the open-source Codex CLI, where researchers got apply_patch to write outside the project folder