Accomplish AI researcher Oren Yomtov disclosed two OpenAI Codex sandbox escapes, the more serious dubbed Heapjack. Codex Desktop installs a node_repl component into the global config with no opt-in, and plain Codex CLI users inherit it. That process runs trusted OpenAI code and untrusted agent code in one Node instance sharing a heap, where a random authorization token sits in memory. Untrusted code snapshots the heap, recovers the token, and writes requests onto the pipe to an unsandboxed parent process, reaching any Unix socket including a Docker daemon. Opening a malicious repository and asking about the code yields unsandboxed execution with no prompt.
Air Security reported that four AI coding agents fetch plugins pinned to a reviewed commit hash but never verify the code they receive matches it. On code hosts that permit branch names shaped like commit hashes, such as Bitbucket or self-hosted git, a plugin repository owner can point that name at different code, so the agent installs malicious code while reporting the locked version. Because plugins run with the user's access, the swapped code reaches files, credentials, and connected systems. Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0; GitHub Copilot has no fix, and Google will not patch the retiring Gemini CLI.
Researchers described Agent Data Injection, a new twist on prompt-injection attacks against AI agents. Rather than smuggling in fake instructions, it exploits the weak separation between trusted and untrusted data so that attacker-supplied content is mistaken for the agent's own trusted data, using deliberately ambiguous delimiters the model misreads. In tests against web and coding agents, this let an attacker steer an agent's clicks or actions, succeeding up to half the time even against defenses that block ordinary instruction injection. Some approaches helped: tagging page elements with random, unguessable identifiers roughly halved success, while strict tracking of where data came from stopped it but sharply reduced how many tasks agents completed.
TrustStrike Labs