How the sandbox evasion worked in practice
In September 2026, security researchers identified two distinct methods to escape the OpenAI Codex sandbox, enabling unauthorized command execution on host systems. One technique allowed running arbitrary commands on a developer's machine even when Codex operated in its most restricted mode, without triggering any user prompts or visible indicators. Both vulnerabilities were responsibly disclosed to OpenAI prior to public reporting.
Breaking news
Trump Orders Federal Agencies to Adopt „Super Intelligence” Terminology
The Silicon Valley Accountability Gap
Running a Local AI Model on a Phone Handles Most Chat Prompts
Google Photos Could Soon Offer a Fresh Start with Ask Photos FeatureThe first escape route exploited a flaw in how Codex handled file system access within its containerized environment, allowing researchers to break out by manipulating path resolution logic. The second method leveraged insufficient input validation in Codex's plugin interface, where specially crafted prompts could trigger unintended system calls. Together, these flaws demonstrated that even sandboxed AI coding assistants could become vectors for local privilege escalation if not properly hardened.
Could this happen again with future AI coding tools?
Researchers demonstrated that by submitting a seemingly innocuous coding request, Codex could be induced to execute shell commands outside its intended boundary. In one test, a command to list directory contents escalated to full remote code execution without user interaction. The attack required no elevated privileges from the user and left no trace in standard application logs, making detection difficult. OpenAI confirmed the issues affected Codex versions prior to a September 2026 update that tightened sandbox controls.
Experts warn that as AI models gain deeper integration with development environments, the attack surface for sandbox escapes will likely grow. The incident highlights the need for continuous security auditing of AI tooling, particularly around process isolation and prompt sanitization. OpenAI stated it has since implemented additional layers of defense, including stricter syscall filtering and enhanced monitoring for anomalous behavior within Codex sessions.
What did the researchers actually achieve with the sandbox escape? They demonstrated the ability to run arbitrary commands on a developer's host machine from within Codex's most secure mode, without any user approval or visible output.
Frequently Asked Questions
Was user data or code at risk during these exploits? While the primary risk was unauthorized command execution, researchers noted that access to local files—including source code and environment variables—could have been obtained if combined with other local vulnerabilities.
Has OpenAI fixed the issues reported by the researchers? Yes, OpenAI confirmed that patches were deployed in September 2026 to address both escape vectors, strengthening the Codex sandbox against similar bypass techniques.
