Security researchers discovered two sandbox escape vulnerabilities in OpenAI's Codex coding agent. The more critical flaw, called Heapjack, allows remote code execution on a developer's machine by exploiting shared memory between trusted and untrusted JavaScript contexts. Both vulnerabilities were reported to OpenAI in August and patched within eight days.
A sandbox escape vulnerability in Claude Code allowed untrusted repositories to execute commands on macOS outside the sandbox without permission prompts by exploiting git's core.fsmonitor configuration setting. Anthropic patched the issue in version 2.1.247 by blanking the core.fsmonitor value in all harness git commands.