RESEARCHERS have disclosed two sandbox-escape vulnerabilities in OpenAI Codex, reporting that attackers could abuse the tool’s trusted functionality and boundary controls rather than directly defeating its underlying isolation. The issues were reported to OpenAI on 12 August 2026. The article does not provide CVE identifiers or evidence of exploitation in the wild.
The first flaw affected the Codex CLI patching utility. Specially crafted patch content could expand file-writing privileges beyond the current workspace, while symbolic links could redirect writes into users’ home directories or other sensitive locations. The attack could reportedly occur without an additional authorisation prompt. OpenAI fixed this issue in Codex CLI 0.149.0, released on 21 August 2026; version 0.155.1 is identified as the latest release.
The second vulnerability affected the Node.js tool bundled with Codex Desktop. Because trusted and AI-generated untrusted code shared part of the process memory, untrusted code could reportedly extract authentication tokens and use them to send requests to native programmes capable of launching applications, accessing Unix sockets or changing global configuration.
The article says this could work even in strict read-only mode, without user approval, if a user opened a repository containing malicious content and prompt injection influenced the agent. The issue was patched in Codex Desktop 26.818.21641 and later. Users should upgrade the CLI and Desktop editions to those versions or newer.