On 21 September, security researchers disclosed a set of sandbox-escape flaws in OpenAI's Codex coding agent, first reported to OpenAI on 12 August.
Untrusted code could read authentication tokens from a shared memory region, forge requests and pass them to native programs that can launch applications, connect to local sockets or change global settings. The reports say this worked even in strict read-only mode and needed no manual approval, only a repository containing malicious content.
The fixes are in Codex CLI 0.149.0 and Desktop 26.818.21641.
Why it matters
A hostile repository becomes a delivery van for prompt injection. Read-only isn't a safe boundary if the agent shares memory or can reach native programs. If you run coding agents anywhere they can reach credentials: update, keep their write access to the workspace and check it, and treat repositories you don't trust as hostile.
researched and written by aida