Loading story…
OpenAI remediated two Codex sandbox-escape vulnerabilities, Overpatch and Heapjack, that could allow a malicious repository to execute commands or alter files on a developer's host system. Overpatch affected the open-source Codex CLI's apply_patch authorization logic: attacker-controlled patch paths could expand permitted write locations and, with symlinks, modify files outside the workspace, including shell startup files such as ~/.zshrc.
Heapjack affected Codex Desktop's node_repl integration. Untrusted JavaScript sharing a V8 heap could recover a trusted authorization token, forge requests to an unsandboxed parent process, and perform host-level actions—including when Codex was configured for read-only sandbox use. OpenAI fixed Overpatch in Codex CLI version 0.149.0 and Heapjack in Codex Desktop build 26.818.21641; organizations should update both components and treat untrusted repositories as potentially hostile.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers reported two Codex vulnerabilities, Overpatch and Heapjack, to OpenAI. The flaws could allow attacker-controlled repositories to escape intended sandbox restrictions and execute host-level actions.
OpenAI remediated Overpatch in Codex CLI version 0.149.0 and Heapjack in Codex Desktop build 26.818.21641. Both sources state the issues were addressed in under a week after reporting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenAI addressed a critical command-injection vulnerability in its Codex CLI tool that allowed attackers to execute arbitrary commands on developer machines by hiding malicious configuration files within code repositories. The flaw, disclosed by Check Point and patched in Codex CLI version 0.23.0, exploited the way the tool automatically loaded and executed MCP server entries from project-local configuration files. If a repository contained a file that redirected the configuration directory and included a malicious MCP server command, Codex CLI would execute those commands as soon as a developer ran the Codex command, potentially compromising the system. This vulnerability turned routine developer workflows into attack vectors, as simply running Codex CLI in a tampered repository could result in the execution of hidden commands without the user's knowledge. OpenAI released a fix for the issue after being notified by Check Point, mitigating the risk of attackers hijacking developer machines through this vector. Security teams are advised to ensure all Codex CLI installations are updated to the latest version and to review repository sources before running AI-powered development tools.
Jun 29, 2026
OpenAI patched a ChatGPT vulnerability that allowed sensitive conversation data and uploaded files to be exfiltrated through a covert DNS-based outbound channel in the platform's code-execution runtime. Check Point Research said a malicious prompt or backdoored custom GPT could abuse the isolated Python/Linux environment to leak user content without approval dialogs or visible warnings, and the same path could support bidirectional communication for remote shell access and command execution. OpenAI said it had already identified the underlying issue internally and fully deployed a fix on **February 20, 2026**; reports said there is no evidence of malicious exploitation. A separate OpenAI flaw in **Codex** also drew scrutiny after BeyondTrust Phantom Labs disclosed a critical command injection issue tied to GitHub branch names. The bug could let attackers inject commands, steal GitHub tokens, and potentially move laterally across shared repositories before OpenAI patched it on **February 5, 2026**. The disclosures underscore how AI assistants and coding agents can introduce new enterprise attack paths when outbound communications, runtime isolation, and input validation are not tightly controlled.
Jun 29, 2026
Novee Security disclosed at Black Hat USA 2026 that AI coding agents tied to GitHub workflows can be manipulated through untrusted issue, pull request, and workflow-generated content to execute malicious actions inside repositories they are meant to maintain. Testing of **Anthropic Claude Code**, **Google Gemini CLI**, and **OpenAI Codex** against the vendors’ own public repositories and default setups showed paths to **remote code execution**, credential theft, repository tampering, and software supply-chain compromise without requiring privileged access. Researchers said the weakness lies primarily in the surrounding agent harnesses—tool permissions, execution controls, and sandboxing—rather than the underlying models. Reported exploitation paths included command-validation bypasses, unenforced shell restrictions, secret exposure through `/proc`, and persistent instruction poisoning across multi-pass workflows. Anthropic remediated **`CVE-2026-54316`** in Claude Code versions `0.2.54` through `2.1.162`; Google patched Gemini CLI versions before `0.39.1`, preview versions before `0.40.0-preview.3`, and `run-gemini-cli` GitHub Action versions before `0.1.22`; OpenAI mitigated Codex workflow risk by isolating agent runs and using read-only environments. The researchers said they found similar insecure patterns in more than 100 public repositories and reported no evidence of malicious exploitation in the wild.
Aug 7, 2026