Codex left the sandbox: open a repo, ask a question, and read-only was not the last word

Sunday's named clock is still the kernel. Tomorrow, September 21, is the CISA trio we wrote Saturday. This morning we added four more local-root bugs with public tests, a Play listing against a Calgary golf club, and the Digital Watchdog recorder advisory. Those are servers, a membership file, and a box on the yard LAN. The story that landed today and will not make that list is a coding agent that thought read-only meant read-only.

BleepingComputer published it this morning. Oren Yomtov at Accomplish AI reported two escapes from the OpenAI Codex sandbox on August 12. OpenAI shipped fixes in eight days. Heapjack, the worse of the two, works from the strictest mode: open someone else's repository in Codex, ask a question about the code, and the person who wrote that repository gets unsandboxed commands on your machine. No prompt. Nothing on the screen. Overpatch is the CLI cousin. In workspace-write mode a shell aimed at the home directory is refused. Codex's own patch tool could still be talked into writing there. We are not going to walk either path. The operational fact is enough: the fence was inside the yard it was supposed to fence.

What "sandboxed" was supposed to mean

Coding agents run model actions in a box so untrusted code cannot touch the rest of the laptop. Heapjack sat in a helper Codex Desktop writes into the shared config at install. CLI users inherited it without a checkbox. Trusted code and untrusted code shared one process and one heap. The token that proved "this side is us" was a string in that heap. Once the untrusted side could read it, the parent process that is not sandboxed believed the request. Accomplish's test launched an app outside Codex's tree. The same seat reaches a Unix socket, including a Docker socket if one is listening.

Overpatch is the older mistake with a new name. The tool decided its own write scope from the paths in the patch. Widen the scope, then write a file the next shell will trust. Pillar Security showed the same shape in July across Cursor, Codex, Gemini CLI, and Antigravity: the agent stays "inside," a trusted tool outside later runs what it wrote. A sandbox that takes instructions from the inmate is a room divider.

Why a shop in Alberta should care

Friday we wrote Plugin4Shell: an agent that thought a pin was a pin. That one was a plugin resolver. This one is "I opened a repo to ask a question." Developer laptops already hold cloud keys, git tokens, and the path to production. You do not need a nation-state. You need one public repo a tired person cloned on a Sunday.

Plugin4Shell's Codex fix was 0.146.0. Today's numbers are newer: Desktop 26.818.21641 and CLI 0.149.0. If you patched on Friday and stopped, check the build again. The Slack announcement is not evidence. The version on the machine is.

The rest of Sunday, in one paragraph

Hacktron's July bounty against OpenAI (a Discourse image bug plus an SSO issue, a $6,500 payout, a harmless PR as proof) is the same neighborhood from the other direction: forum to employee Codex to GitHub. We are not going to recap their chain. Canadian Cyber Centre alert AL26-021 still sits on Cisco ISE, including the exploited 10.0 (CVE-2026-76460). Re-image if you think a node was touched; a root on ISE can wipe the local log. Windows Update Stack CVE-2026-81963, which we flagged on Patch Tuesday, has a federal due date of September 22. Local to SYSTEM, already used. Tomorrow is the Linux KEV trio. The four public local-root tests from this morning ride in the same reboot if you can stand one window.

What we would check before Monday

• Codex Desktop 26.818.21641 or later. Codex CLI 0.149.0 or later. Confirm on the laptop, not in the ticket.
• Do not open a stranger's repository in an agent and "just ask a question" until that build is what is actually running. Read-only was not a promise last month.
• If Docker or another privileged socket is on a developer machine, treat an old Codex as a path to that socket, not a text box.
• ISE: Cyber Centre's sentence still stands. Patch, restrict management, and re-image if the node looks dirty.
• Kernel reboot tomorrow. Update Stack by Tuesday. Digital Watchdog firmware and the Inglewood listing are this morning's other two; they do not move.

Bottom line

A coding agent with a dishonest sandbox is a laptop problem that looks like a convenience feature. Forensic Five reviews what developers actually run, including the tool that was supposed to stay in its box. From St. Albert, Alberta. Update Codex. Then go finish the kernel.