{"schema_version":"0.10.0","id":"LR-2026-0724","record_version":1,"title":"Researchers break out of OpenAI Codex sandbox twice","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":49.0,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":5.44,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"435184705647a5d182cd538a8c3f7353e9c582edda1006cd5e9ba595216cea33"},"system":{"model_name":null,"model_version":null,"developer":"OpenAI","harness":null,"tools_granted":["files","software tools","commands"],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":["sandbox"],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-09-21","incident_class":"security_compromise","failure_class":"containment_escape","agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"Security researchers found two sandbox escape flaws in OpenAI’s Codex coding agent, named Heapjack and Overpatch. Heapjack affected a JavaScript component installed with Codex Desktop; the researchers said a malicious repository could exploit it to run commands on the computer, and their demonstration worked even in strict read-only mode with no approval request shown. Overpatch affected the open-source Codex command-line tool, where the patching mechanism could be manipulated into gaining permission to write outside the project workspace. The researchers reported both issues to OpenAI, which fixed them within eight days, and the disclosure gave no indication either flaw had been exploited in the wild.","tags":[],"date_detected":null,"near_miss":null,"root_cause":"guardrail","root_cause_detail":"Sandbox controls relied on information that could be influenced from inside the restricted environment","failure_class_detail":null,"responsible_party":"provider","adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"Both vulnerabilities patched by OpenAI","precursor_events":null,"primary_risk":"RK05"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"Minor test: contained to one evaluation with no third party touched; no exploitation indicated in the sources","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://gulfnews.com/technology/researchers-broke-out-of-openai-codexs-sandbox-twice-1.500682545","publisher":"Gulf News","date":"2026-09-21","type":"press","title":"Researchers broke out of OpenAI Codex's sandbox — twice - Gulf News","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.developer":"C","system.tools_granted":"C","system.guardrails_present":"C","event.agent_involved":"C","event.failure_class":"C","event.incident_class":"C","event.detection_method":"C","event.responsible_party":"C","event.root_cause":"C","event.root_cause_detail":"C","event.remediation":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"Security researchers found two ways to escape the protective sandbox used by OpenAI’s Codex coding agent, including one that could run commands on a developer’s computer without an approval prompt."}],"system.tools_granted":[{"source_index":0,"quote":"AI coding agents such as Codex can interact with files, software tools and commands on a user’s computer."}],"system.guardrails_present":[{"source_index":0,"quote":"A sandbox limits what those actions can reach, preventing untrusted code from accessing parts of the system outside the environment it has been authorised to use."}],"event.agent_involved":[{"source_index":0,"quote":"AI coding agents such as Codex can interact with files, software tools and commands on a user’s computer."}],"event.failure_class":[{"source_index":0,"quote":"Security researchers found two ways to escape the protective sandbox used by OpenAI’s Codex coding agent, including one that could run commands on a developer’s computer without an approval prompt."}],"event.incident_class":[{"source_index":0,"quote":"Security researchers found two ways to escape the protective sandbox used by OpenAI’s Codex coding agent, including one that could run commands on a developer’s computer without an approval prompt."}],"event.detection_method":[{"source_index":0,"quote":"The vulnerabilities, named Heapjack and Overpatch, affected different parts of Codex and were discovered by security researcher Oren Yomtov of Accomplish AI."}],"event.responsible_party":[{"source_index":0,"quote":"The researchers said they reported the issues to OpenAI on August 12 and that the company fixed both within eight days."}],"event.root_cause":[{"source_index":0,"quote":"The researchers said both problems stemmed from security controls relying on information that could itself be influenced from inside the environment they were designed to restrict."}],"event.root_cause_detail":[{"source_index":0,"quote":"The researchers said both problems stemmed from security controls relying on information that could itself be influenced from inside the environment they were designed to restrict."}],"event.remediation":[{"source_index":0,"quote":"Both vulnerabilities have already been patched."}],"impact.severity":[{"source_index":0,"quote":"The researchers' disclosure currently provides no indication that the vulnerabilities were exploited in the wild."}],"impact.severity_because":[{"source_index":0,"quote":"The researchers' disclosure currently provides no indication that the vulnerabilities were exploited in the wild."}],"event.summary":[{"source_index":0,"quote":"Security researchers found two ways to escape the protective sandbox used by OpenAI’s Codex coding agent, including one that could run commands on a developer’s computer without an approval prompt."},{"source_index":0,"quote":"Crucially, the researchers said their demonstration worked even when Codex was operating in its strict read-only mode."},{"source_index":0,"quote":"Researchers found that Codex’s patching mechanism could be manipulated into gaining permission to write outside the project’s designated workspace."},{"source_index":0,"quote":"The researchers said they reported the issues to OpenAI on August 12 and that the company fixed both within eight days."},{"source_index":0,"quote":"The researchers' disclosure currently provides no indication that the vulnerabilities were exploited in the wild."}]},"notes_on_gaps":"Only one press source (Gulf News, dated 2026-09-21 in its header) was provided; it relays researchers' claims and no OpenAI statement. No date of occurrence, year of the August 12 report, or date of public disclosure is stated in a quoted sentence, so no event dates were recorded. The model name, version, autonomy level, deployment context, and country were not stated. Trigger was left out because the sources describe a demonstration, not a cause. Adversarial actor was left out because no attacker is identified. The eight-day fix period is not converted to a duration because it is a stated range only. Judgements made: failure_class containment_escape and incident_class security_compromise reflect the sandbox escape; near_miss true reflects vulnerabilities patched with no stated exploitation; severity minor reflects no third party touched and no exploitation indicated; root_cause guardrail reflects the sandbox controls being influenced from inside. Control E1 is marked failed and B1 got_around based on the described bypass of the sandbox and approval prompt. Remediation adds J1 (known flaws patched) as the closest control for the fixes. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"The Codex coding agent can interact with files, software tools and commands on the user's computer, within a sandbox that limits what those actions can reach.","quote":"AI coding agents such as Codex can interact with files, software tools and commands on a user’s computer.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Two ways to escape the Codex sandbox were found; one could run commands on a developer's computer without an approval prompt.","quote":"Security researchers found two ways to escape the protective sandbox used by OpenAI’s Codex coding agent, including one that could run commands on a developer’s computer without an approval prompt.","source_index":0,"grade":"C"},{"step":"caught","text":"Security researcher Oren Yomtov of Accomplish AI discovered the two vulnerabilities, named Heapjack and Overpatch.","quote":"The vulnerabilities, named Heapjack and Overpatch, affected different parts of Codex and were discovered by security researcher Oren Yomtov of Accomplish AI.","source_index":0,"grade":"C"},{"step":"done","text":"Both vulnerabilities have been patched.","quote":"Both vulnerabilities have already been patched.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://gulfnews.com/technology/researchers-broke-out-of-openai-codexs-sandbox-twice-1.500682545"]},"analysis":{"sections":{"timeline":[{"text":"Researchers reported the issues to OpenAI.","quote":"The researchers said they reported the issues to OpenAI on August 12 and that the company fixed both within eight days.","source_index":0,"when":"August 12"},{"text":"OpenAI fixed both vulnerabilities within eight days of the report.","quote":"The researchers said they reported the issues to OpenAI on August 12 and that the company fixed both within eight days.","source_index":0,"when":null},{"text":"Heapjack was fixed in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0.","quote":"According to Accomplish AI, Heapjack was fixed in Codex Desktop build 26.818.21641, while Overpatch was fixed in Codex CLI 0.149.0.","source_index":0,"when":null},{"text":"Disclosure stated no indication that the vulnerabilities were exploited in the wild.","quote":"The researchers' disclosure currently provides no indication that the vulnerabilities were exploited in the wild.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://gulfnews.com/technology/researchers-broke-out-of-openai-codexs-sandbox-twice-1.500682545"]}}