Researchers Escape OpenAI Codex Sandbox to Run Commands on Host
Security researchers found two ways to escape OpenAI Codex sandbox, allowing remote code execution and unauthorized access.
Intelligence analysis by Qwen 2.5 (3B)
Security researchers discovered two vulnerabilities in OpenAI Codex that allow remote code execution and unauthorized access, prompting immediate fixes.
Security researchers found two ways to trick an AI tool into letting them run their own code. One way was to guess a special code, and the other was to trick the tool into writing to a folder it shouldn't. Both were fixed quickly by the tool's creators.
Analysis
{"heading_1":"The Heapjack Technique","subheading_1":"Targeting Node.js Component","paragraph_1":"OpenAI fixed both vulnerabilities in Codex Desktop build 26.818.21641 and Codex CLI 0.149.0, releasing updates to users.","paragraph_2":"The researchers credited OpenAI for resolving the issues within eight days of their report.","paragraph_3":"The patch tool grants write access to the parent folder of each path named in the patch, allowing the attacker to execute their code.","heading_2":"The Overpatch Technique","subheading_2":"Exploiting Patch Tool","heading_3":"Immediate Fixes","subheading_3":"OpenAI's Response"}
Key points
- Two vulnerabilities were found in OpenAI Codex
- The Heapjack technique involved guessing a UUID token
- The Overpatch technique used a patch tool to bypass sandbox restrictions
- OpenAI released updates to fix the vulnerabilities
- The vulnerabilities highlight the need for more robust security measures in AI tools
The fixes will help prevent similar attacks in the future, ensuring more secure AI tools.
While the fixes are in place, the vulnerabilities show that AI tools still need to be more secure to prevent unauthorized access.
