Opening a stranger's repo in OpenAI Codex handed its author commands on the host

node_repl runs one Node.js process that holds two JavaScript contexts. One is trusted and carries OpenAI's own code; the other is untrusted and carries the agent's. The trusted side proves itself to a native parent process with a random token generated fresh on each run ^[5]. Both contexts share one memory heap, so the token is a string the untrusted side can read ^[6]. The untrusted code takes a snapshot of that heap with v8.getHeapSnapshot() and tries every string shaped like a UUID. A wrong guess returns "not authorized". A correct token with a bad argument returns a real validation error, and the attacker keeps that one ^[7].

With the token, the untrusted code writes its own request onto the same pipe the trusted context uses to talk to the native, unsandboxed parent, and the parent checks the token and runs the request ^[8]. The proof of concept called the system open command to launch an application outside Codex's process tree entirely, and the same access reaches any Unix socket on the machine, a Docker daemon socket being the obvious target, along with a tool for editing the global config file ^[9].

Overpatch is cruder and sits in the open-source CLI. In workspace-write mode the agent may only write inside the project folder, and a shell command aimed at the home directory is refused ^[11]. The researchers went through apply_patch instead. The working exploit pairs the /tmp hunk with a second change that appends a line to .zshrc through a symlink into the home directory; remove the /tmp hunk and the write is refused ^[13]. The next terminal the developer opens runs the attacker's line unsandboxed ^[13].

Both bugs put the enforcement inside the thing being enforced ^[14]. apply_patch worked out its own permissions from attacker-supplied input, and node_repl kept the secret dividing trusted from untrusted code in memory the untrusted code could read ^[14]. Pillar Security showed a relative of this in July 2026 across Cursor, Codex, Gemini CLI and Google's Antigravity, where an agent that stays inside its sandbox writes a file that a trusted tool outside the sandbox later runs ^[15].

An anonymous reply to Yomtov's post on X wrote that "V8 contexts isolate globals, not memory, so the sandbox was really a promise the heap never agreed to" ^[17]. A second anonymous reply to the same post called the trust boundary "a room divider" ^[18].

Yomtov says both bugs went to OpenAI on August 12 and were fixed within eight days ^[2][19]. Eight days puts the patched code on or before August 20. The fixes shipped in two separate products, so the version to check depends on which client is installed ^[16][20]. Working out whether a machine ever carried the vulnerable tool means reading ~/.codex/config.toml ^[4][21].