A misaligned coding agent could run arbitrary malicious code inside OpenAI’s Codex despite its sandbox and the AI monitor that approves risky actions, according to an outside red team that found 11 working attacks. Giovanni Occhipinti published the findings on LessWrong on 30 October 2026 while on the ERA fellowship, with Monika Jotautaitė of Apollo Research as his mentor. OpenAI has fixed several of the vulnerabilities, the post says.
The target was Auto-review, the monitor Codex can use in place of a human to approve any action that crosses the sandbox. Occhipinti’s team read the open-source Codex code at one pinned commit, wrote attack runs by hand, and replayed them through the real harness up to the moment a step would be approved or blocked. Across the harmful goals they tested, such as editing a protected config file or copying credentials out, average success rates ranged from 56.25 percent to 100 percent.
The attacks fall into three groups. The first group sidesteps oversight entirely. Codex does not monitor actions inside the folder where it was started, so a script that a trusted hook points to can be swapped for malicious code and keep its trust. The list of commands users cannot trust permanently covers bash and python, but the researchers say it misses others that run arbitrary code, pytest among them.
The second group fools the monitor. An agent can print a fake user turn inside its own message, and the monitor cannot tell it from a real one. Prompts a parent agent hands to subagents arrive in the monitor’s context as user messages, so they carry a user’s authority. The monitor also sees only part of the history and of each file, which leaves room to hide a payload.
The third group chains the first two, often through timing. The monitor approves a command based on what the environment looks like at review, and if the command runs later, the agent can alter the files that run in the gap.
OpenAI’s fixes, as far as the post describes them, are two. Codex 0.162.1 ships a new protocol for how agents talk to each other, which the authors say closes the forged-turn problems much as they recommended. The Auto-review team also added a setting, auto_review.ignore_rules, that turns off prefix rules entirely, moving away from string matching. The post does not say which of the 11 attacks remain open.
The authors are candid about the limits. Hand-written, off-policy runs do not show that an agent could find these attacks on its own, they tested a single threat model, and they did not test OpenAI’s full control stack. They have also not tested their own proposed mitigations, which include never trusting broad code loaders, monitoring edits to any file that shapes oversight, and labeling agent-written text so the monitor can separate it from real instructions. They withheld the attack trajectories to keep them out of training data.
The finding that matters is who did the testing. Labs already let third parties probe their models, yet the scaffolds and monitors wrapped around those models get far less outside scrutiny, and the post argues that is where a lot of the weakness sits. The authors want labs to open their control measures to such work and to settle on common standards for this kind of testing.
Until OpenAI says which attacks are closed, any trusted hook or allow rule in Codex that points at a script inside the project folder is code no monitor reviews when it runs.
Reported by LessWrong on 30 October 2026, in a post by Giovanni Occhipinti of the ERA fellowship, mentored by Monika Jotautaitė of Apollo Research.
