OpenAI Codex Sandbox Escape: Defending Against AI Agent Command Execution on Developer Hosts

---
title: AI Coding Agent Spawning Interactive Shell or Script Interpreter
id: 3f8a1c92-7d4e-4b6a-9e21-5c0d2f8a1b34
status: experimental
description: Detects AI coding agent runtimes (Codex/Node-based agents, Claude Code, etc.) spawning interactive shells or script interpreters with remote-content or encoded arguments, consistent with sandbox escape or prompt-injection-driven command execution on developer hosts.
references:
  - https://www.bleepingcomputer.com/news/security/researchers-escape-openai-codex-sandbox-to-run-commands-on-host/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'codex'
      - 'node'
    ParentImage|endswith:
      - '\node.exe'
  selection_child_shell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  selection_child_args:
    CommandLine|contains:
      - '-enc'
      - '-encodedcommand'
      - 'iex'
      - 'invoke-webrequest'
      - 'invoke-expression'
      - 'downloadstring'
      - 'mshta http'
  condition: selection_parent and selection_child_shell and selection_child_args
falsepositives:
  - Agent-driven build scripts that legitimately invoke PowerShell installers
level: high
---
title: Process Accessing Developer Credential Stores Followed by Agent-Spawning Chain
id: 8b2e4f17-3a9c-4d58-bf62-7e1a0c5d9f28
status: experimental
description: Detects reads of SSH keys, cloud credentials, or git credential stores by shell processes whose lineage traces back to a scripting interpreter, a pattern consistent with post-escape credential harvesting on a developer workstation.
references:
  - https://www.bleepingcomputer.com/news/security/researchers-escape-openai-codex-sandbox-to-run-commands-on-host/
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_shell:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\findstr.exe'
      - '\type.exe'
  selection_paths:
    CommandLine|contains:
      - '\.ssh\'
      - 'id_rsa'
      - 'id_ed25519'
      - '\.aws\credentials'
      - '.git-credentials'
      - '.npmrc'
      - '.netrc'
  condition: selection_shell and selection_paths
falsepositives:
  - Developers legitimately inspecting SSH keys or cloud configs
  - Onboarding and dotfiles scripts
level: medium
---
title: Git Hook or Shell Profile Modification as Agent Persistence
id: c5d7a2e4-1f6b-4c83-a9d4-2e8f0b3c6a51
status: experimental
description: Detects writes to git hook scripts and shell startup profiles, a low-noise persistence mechanism usable after an AI agent sandbox escape on developer machines running Windows with Git Bash or WSL tooling.
references:
  - https://www.bleepingcomputer.com/news/security/researchers-escape-openai-codex-sandbox-to-run-commands-on-host/
  - https://attack.mitre.org/techniques/T1546/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1546
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\.git\hooks\post-checkout'
      - '\.git\hooks\post-commit'
      - '\.git\hooks\pre-push'
      - '\.bashrc'
      - '\.bash_profile'
      - '\Documents\PowerShell\Microsoft.PowerShell_profile.ps1'
      - '\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1'
falsepositives:
  - Legitimate hook installation by frameworks such as husky or pre-commit
  - Developer profile customization
level: medium

// Hunt: AI agent runtime (Node/Codex) spawning shells or touching credential material
// Scope: developer workstations via MDE. Review Frequency: daily during exposure window.
let AgentParents = dynamic(["node.exe", "codex", "codex.exe"]);
let ShellChildren = dynamic(["powershell.exe", "pwsh.exe", "cmd.exe", "bash", "sh", "zsh", "wscript.exe", "mshta.exe", "curl.exe", "wget.exe"]);
let SuspiciousArgs = dynamic(["-enc", "-encodedcommand", "iex", "downloadstring", "invoke-webrequest", "base64", "http://", "https://", ".ssh", ".aws/credentials", "git-credentials", "id_rsa", ".npmrc"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName has_any (ShellChildren)
| extend ParentName = tostring(split(InitiatingProcessFileName, "\\")[-1])
| where InitiatingProcessFileName has_any (AgentParents)
   or InitiatingProcessCommandLine has "codex"
| extend HitArgs = set_intersect(SuspiciousArgs, dynamic([ProcessCommandLine]))
| where ProcessCommandLine has_any (SuspiciousArgs)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ReportId
| sort by TimeGenerated desc;

// Hunt: Enumerate shell/interpreter processes spawned by Node-based agent runtimes
// and check for reads of credential artifacts on developer endpoints.
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)(powershell|pwsh|cmd|bash|sh|zsh|curl|wget|mshta)'
   AND CommandLine =~ '(?i)(-enc|encodedcommand|iex|downloadstring|base64|http://|https://|\.ssh|\.aws|git-credentials|id_rsa|npmrc)')

#!/usr/bin/env bash
# Codex agent hygiene check for developer workstations (macOS/Linux).
# Verifies the installed Codex version, flags overly permissive approval
# settings, and lists shell profile / git hook drift for review.
set -euo pipefail

echo "==[ Codex version check ]=="
if command -v codex >/dev/null 2>&1; then
  codex --version || true
  echo "ACTION: Confirm this is the latest release from https://github.com/openai/codex/releases"
  echo "        Releases after the sandbox-escape disclosure contain the fixes."
else
  echo "codex not found on PATH"
fi

echo
echo "==[ Codex configuration audit ]=="
for cfg in "$HOME/.codex/config.toml" "$HOME/.codex/config.json"; do
  if [ -f "$cfg" ]; then
    echo "Found: $cfg"
    if grep -Eqi 'full-auto|danger|never|bypass|unrestricted|workspace-write.*false' "$cfg"; then
      echo "WARNING: Potentially permissive approval/sandbox setting detected in $cfg:"
      grep -Ein 'approval|sandbox|full-auto|danger|bypass' "$cfg" || true
      echo "ACTION: Require interactive approval and the strictest sandbox mode."
    else
      grep -Ein 'approval|sandbox' "$cfg" || echo "No explicit sandbox/approval keys — defaults apply. Verify them."
    fi
  fi
done

echo
echo "==[ Persistence surface: shell profiles modified in last 14 days ]=="
for f in "$HOME/.bashrc" "$HOME/.bash_profile" "$HOME/.zshrc" "$HOME/.profile"; do
  [ -f "$f" ] && find "$f" -mtime -14 -print 2>/dev/null
done

echo
echo "==[ Persistence surface: git hooks modified in last 14 days under home repos ]=="
find "$HOME" -type d -name hooks -path '*/.git/*' 2>/dev/null | while read -r h; do
  find "$h" -type f -mtime -14 -not -name '*.sample' -print 2>/dev/null
done

echo
echo "==[ Recent suspicious child processes of node (last 200 lines of audit log, if present) ]=="
if command -v ausearch >/dev/null 2>&1; then
  ausearch -k exec -ts recent 2>/dev/null | grep -Ei 'node.*(bash|sh |curl|wget)' | tail -n 20 || echo "no matches"
else
  echo "auditd not available; rely on EDR telemetry for process lineage."
fi

echo
echo "DONE. Review all flagged items against expected developer activity."