Preliminary research

Escaping the OpenAI Codex sandbox, twice

Escaping the OpenAI Codex sandbox, twice — Accomplish Blog

Oren Yomtov · Accomplish · 15 September 2026

AI-collected research leads through 1 October 2026, including a bounded September review of selected social and community sources. Unranked, incomplete, not community-vetted, and subject to change.

Two Codex sandbox escapes abused enforcement plumbing. One widened patch-derived write grants and crossed a symlink; the other recovered a trust token from a V8 heap shared with untrusted code and forged requests to an unsandboxed native parent.

Record

Document

Escaping the OpenAI Codex sandbox, twice — Accomplish Blog

Researcher

Oren Yomtov

Published by

Accomplish

Date

15 September 2026

Topic

Other

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• ai-agent
• sandbox-escape
• file-write
• rce
• privilege-escalation
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Oren Yomtov, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 1 October 2026.