OpenAI released Codex rust-v0.151.0 at 09:55 UTC on 29 August. Under the heading Bug Fixes sit five entries that are not bug fixes in the ordinary sense — they are sandbox and permission boundary repairs.
The directory-change item
The clearest of them states that the release "prevented `/cd` from weakening sandbox restrictions." The failure it describes is structural: a sandbox is normally anchored to a working directory, and a command that moves that anchor can widen the enclosure it is supposed to define. If the user can move the boundary, so can anything that can make the agent issue the command — which, in a tool that reads repository files and web pages, is a broad set of inputs.
The staleness item
A second entry addresses classifications that remained authorising after the permission state had changed. A user tightening permissions mid-session would have expected the tightening to apply; cached decisions meant it did not, for actions already classified. Permission systems are judged on exactly this: whether revocation takes effect immediately.
What the common framing gets wrong
The Bug Fixes heading invites readers to treat these as ordinary defects, and the sparse advisory history of the project — one advisory ever — invites the conclusion that its sandbox has been quiet. The comparison that settles it is with a competitor: the working-directory class of escape was treated as high severity, with a published advisory, by another vendor earlier this year. Identical class, different disclosure decision. A thin advisory record is evidence about a project's disclosure practice, not about its defect rate, and the two are routinely confused.
The pattern across the day
Two of the largest coding agents shipped sandbox-boundary repairs inside fifteen hours of each other, both through release notes and neither through a security channel. Whatever the merits in each case, the effect for anyone monitoring these tools centrally is the same: the security feed is the changelog.