decrypted · 20 september 2026 · vulnerabilities and patching · uk policy and law · ai and llm security

Codex's sandbox escapes: the guard was inside the cell

Since this morning's bulletin, BleepingComputer has reported two sandbox escapes in OpenAI's Codex coding agent, found by researchers at Accomplish AI. Both are fixed, so this is not an emergency. It is, though, a clean lesson in how not to build a security boundary, and it matters to any UK team letting an AI agent loose on its code.

What the researchers found

A coding agent runs code it did not write, so vendors wrap it in a sandbox: a restricted room where the agent can work but cannot touch the rest of your machine. Accomplish AI researcher Oren Yomtov found two ways out.

Heapjack affected Codex Desktop. The agent's JavaScript ran in one process split into two zones, one trusted and holding an authentication token, one untrusted and running agent code. Both zones shared the same memory. The untrusted zone could snapshot that memory, lift out the token, and use it to ask the parent process to run commands outside the sandbox. According to the write-up, opening a cloned repository in read-only mode was enough, with no prompt to the user.

Overpatch affected the command-line tool. Its patch feature granted write access to the parent directories of any path named in a patch. Name /tmp in a patch that is meant to fail, and the tool has already handed over write access to the wider filesystem. A second entry then wrote through a symlink to the user's shell startup file, so the attacker's code ran the next time a terminal opened.

Both were reported on 12 August 2026 and fixed within eight days, in Codex Desktop build 26.818.21641 and Codex CLI 0.149.0. BleepingComputer's report mentions no exploitation in the wild.

The guard was inside the cell

Think of a prison where the gate keys hang on a hook inside the cell block. Nobody has to pick the lock. The researchers put it plainly: "The thing doing the enforcement was sitting inside the thing being enforced."

That is the Secure by Design point. A boundary only holds if the thing being restrained cannot influence it. Heapjack put the credential in the same room as the untrusted code. Overpatch let attacker-supplied input decide how much permission the tool would grant itself. The fix pattern is old and boring: keep enforcement in a separate process, derive permissions from policy rather than input, and give each component the least it needs.

The NCSC made the wider point last December: because a language model cannot tell data from instructions, the best we can hope for is "reducing the likelihood or impact of attacks". Impact is exactly what a sandbox is for.

What to do about it

Update Codex Desktop and CLI, and ask which agent tools your developers actually run.
Treat an untrusted repository as untrusted code, even in read-only mode.
Run agents in a disposable virtual machine or container.
When buying AI tooling, ask suppliers where the enforcement boundary sits and who can change it.

Also this week

Extortion gangs turn on each other. BleepingComputer reported that on 19 September the ShinyHunters group defaced the Tor leak site of the Clop ransomware gang, and confirmed the defacement itself. ShinyHunters claims full server access, theft of source code and Clop's onion-service private keys, and gave Clop 72 hours to make contact. Those claims, including the Grav CMS upload flaw it says it used, are unverified, and I have not seen them independently confirmed. Delightful as the spectacle is, victims should not read it as good news.

Brussels writes "safe by design" into law for children. The European Commission proposed its Kids Act this week: no social media under 13, restricted "mini accounts" with parental oversight for 13 to 15, and a ban on features such as infinite scroll and engagement-driven rewards. It still needs Parliament and member states to agree, and The Record noted the UK has signalled similar plans. The question for UK firms is less the ban than the age checks that enforce it, and who ends up holding the data they produce.

Opinion, not advice.

Sources