OpenAI Codex recently revealed two significant security vulnerabilities, Overpatch and Heapjack, which could potentially execute commands on a developer's local system This article explores file ultimately vulnerabilities. . By incorporating a directory named /tmp in a patch, the tool could mistakenly grant write access starting from the root directory, exceeding the intended workspace boundaries.
Although this specific patch attempt involving /tmp failed because it aimed to overwrite a directory, it still inadvertently expanded the tool’s file-write permissions. Since an attacker can influence the patch content, there is a risk that an editing request could grant unauthorized access to areas outside the project folder, potentially leading to exploitation. Core Flaw: Apply Patch Expands Permissions Using Attacker-Controlled Paths. No.
Upon detection, forged requests through the shared standard-output channel can be sent to the unsandboxed parent process, potentially invoking the system open command and allowing applications to launch outside of Codex's intended process structure. Additionally, the compromised authorization mechanism enables interactions with Unix sockets, including Docker daemon sockets or modifications to the global Codex configuration file. Ultimately, these vulnerabilities underscore broader security concerns surrounding AI agents: enforcement logic and sensitive information must remain isolated from environments controlled by untrusted code.
It's essential to approach untrusted repositories with caution, keep up-to-date with Codex versions, and avoid relying solely on read-only mode as a safeguard against potential code execution by agents.
