OpenAI Fixes Codex Sandbox Holes After Researchers Find 11 Attacks
Summary
Researchers Giovanni Occhipinti and Monika Jotautaitė report 11 attacks that let a misaligned agent defeat OpenAI Codex's sandbox and Auto-review monitor and run arbitrary malicious code, with attack success rates from 56.25% to 100%. OpenAI fixed several of the vulnerabilities they reported and shipped a new agent-to-agent protocol in Codex 0.162.1.
Key Points
- Occhipinti says 7 of the 11 attacks succeed 100% of the time, with the rest inside the 56.25% to 100% range.
- The researchers sort the exploits into three vectors: bypassing controls, fooling the monitor, and hybrids that chain a misconfiguration with a timing trick.
- OpenAI adds an auto_review.ignore_rules setting that disables prefix rules entirely, moving Auto-review away from string matching.