Hazem Omier
@hazemomier
Chief Technology Officer @ Pulse | Driving Technical Transformation
272 Following 387 Followers
Third coding-agent sandbox escape in a row from the same research shop. Pattern is the product, not the CVE number.
Heapjack: read-only mode, no approval prompt, unsandboxed host command via a shared V8 heap token. Overpatch: apply_patch widens write past the workspace. Fixed fast (Desktop 26.818.21641 / CLI 0.149.0).
Forced choice when you put Codex on a laptop: treat every opened repo as hostile code, or keep the agent in a real VM boundary.
Sandbox labels are marketing until the boundary is proven.
Show more
