Researchers Find Two Ways to Break Out of OpenAI Codex Sandbox

Researchers found two ways to escape the OpenAI Codex sandbox, including one flaw that could allow malicious code to run outside normal restrictions simply by opening a repository in Codex.

Security researchers at Accomplish AI discovered the two vulnerabilities, named Heapjack and Overpatch. Researcher Oren Yomtov said the team reported them to OpenAI on August 12, and OpenAI fixed both within eight days.

Heapjack posed the greater risk. A malicious repository could potentially achieve unsandboxed command execution when a developer opened the project in Codex and asked questions about its code. The attack could also work in Codex’s read-only mode without triggering an approval prompt.

Heapjack exposed a trusted authentication token

Heapjack targeted Codex’s node_repl component, which runs trusted OpenAI code and untrusted agent code in separate JavaScript contexts within the same Node.js process.

The two contexts shared the same memory heap. Attackers could use v8.getHeapSnapshot() to search memory for the authentication token used by the trusted context and identify the correct value through differences in validation responses.

After obtaining the token, malicious code could use the trusted communication channel to reach an unsandboxed native parent process. Researchers demonstrated the issue by using the system’s open command to launch an application outside the Codex process tree.

They said similar access could potentially reach Unix sockets, Docker daemon sockets, and tools capable of changing Codex’s global configuration.

Overpatch allowed writes outside the workspace

The second flaw, Overpatch, affected Codex CLI’s workspace-write mode.

Codex’s apply_patch tool calculated write permissions using paths included inside the patch. By referencing /tmp, an attacker could expand the permitted write area to the filesystem root and modify files inside the user’s home directory.

The proof of concept added a command to .zshrc, which would run outside the sandbox the next time the developer opened a terminal.

Accomplish AI said both flaws came from security controls that untrusted code could influence from inside the sandbox.

OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0. Users should update to those versions or newer releases.

In other news, OpenAI disclosed six cases of AI model misalignment, while the company also released ChatGPT Appshots and brought ChatGPT to Word, PowerPoint, and Excel.

Via BleepingComputer