Codex sandbox escape. The access path.
A malicious repository recovered the agent token from the V8 heap. A sandbox whose own credential lives next to attacker-controlled code is not a boundary.
The record
Entry point. malicious-repo, opened in read-only mode.
The identity in the middle. The agent own auth token, recovered with v8.getHeapSnapshot() and then honoured by the parent process.
What was reached. host-execution, unsandboxed, no approval prompt.
A malicious repository recovered the agent token from the V8 heap.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| malicious-repo | Entry | opened in read-only mode |
| node-repl | Step | trusted and untrusted contexts, one V8 heap |
| auth-token | Step | recovered via v8.getHeapSnapshot() |
| parent-process | Step | token validated, request honoured |
| host-execution | Reached | unsandboxed, no approval prompt |
Where a breakpoint would have been
Trusted and untrusted code sharing one V8 heap. Once the token is in the same memory as repository content, every later control is downstream of a value the attacker can already read.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page. The full narrative is in the teardown.
5 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Questions, answered.
The two questions this record answers.
What was the entry point in the Codex sandbox escape incident?
The published path starts at malicious-repo, opened in read-only mode.
What did it reach?
The last step in the published path is host-execution, unsandboxed, no approval prompt.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.