WBR-20260921-003
Codex sandbox escape allegedly found its “key” in shared memory
A security report claims that two flaws let code escape restrictions in OpenAI Codex, a coding agent designed to keep untrusted actions inside a sandbox.
Something’s off.NEW0SINCE LAST VISIT
A trust token in the same Node.js process memory
In the stranger of the two alleged flaws, the sandbox’s trusted and untrusted JavaScript contexts reportedly ran in the same Node.js process. The token used to prove that a request came from the trusted side was allegedly stored in that shared process memory—meaning untrusted code could search memory for it, then use it to send requests to an unsandboxed parent process.
The report says this could happen even in Codex’s read-only mode, and that opening a repository and asking a question about its code could trigger the chain. A separate claimed flaw reportedly let Codex’s patch tool expand its allowed write area using a path named in a patch.
According to the report, OpenAI fixed the issues in Codex Desktop build 26.818.21641 and Codex CLI 0.149.0.
Verification
UNVERIFIED
Feed metadata identifies a report, not independently verified underlying facts.
This is an unverified, source-attributed security report. The underlying claims have not been independently verified by this pipeline.
