Researchers at Accomplish AI reported two ways to escape OpenAI Codex’s sandbox, naming them Overpatch and Heapjack, to OpenAI on 12 August 2026. OpenAI fixed both within eight days. Heapjack reached unsandboxed command execution even in Codex’s strictest read-only mode, while Overpatch let the agent’s own patch tool widen its write permissions beyond the workspace folder.[1]
Overpatch: widening a patch tool’s write grant
In Codex’s workspace-write sandbox mode, the agent is meant to write only inside the project folder; a shell command aimed at the home directory is refused.[1] The researchers found that `apply_patch`, the tool Codex gives the agent for editing files, grants write access to the parent folder of each path named inside a patch. Naming `/tmp` in a patch grants write access to the root of the disk.[1]
The working patch combines two changes. One names `/tmp` and does nothing else, existing only to widen the granted permission. The other appends a line to `.zshrc` through a symlink into the home directory.[1] Removing the `/tmp` entry causes the write to be refused, which is how the researchers isolated its role.[1] With both entries present, the appended line then runs unsandboxed the next time the developer opens a terminal.[2]
Heapjack: a token shared with the code it separates from
Heapjack targets `node_repl`, a component Codex Desktop writes into the global `~/.codex/config.toml` file at install, with no opt-in and no setting to disable it; because the entry lives in the shared config file, plain Codex CLI installations inherit the same tool.[2] `node_repl` runs one Node.js process containing two separate V8 `vm` contexts: a trusted context holding OpenAI’s own code, and an untrusted context running the agent’s code. The trusted context proves its identity to a native, unsandboxed parent process with a random token generated fresh on each run.[1]
Both contexts share one Node process and one V8 heap, so the token is a string sitting in memory the untrusted context can read. The untrusted code takes a heap snapshot with `v8.getHeapSnapshot()` and tests every string shaped like a UUID; a wrong guess returns “not authorized”, while a correct token paired with a bad argument returns a genuine validation error that confirms the guess.[1][2] Holding the token, the untrusted code writes its own request onto the same pipe the trusted context uses to reach the parent process. The parent checks the token, finds it valid, and carries out the request.[2]
The proof of concept used the system’s `open` command to launch an application outside Codex’s process tree. The researchers say the same access reaches any Unix socket, including a Docker daemon socket, and a tool for editing the global config file.[1] All of this runs at read-only, the sandbox mode in which the agent is not supposed to be able to write anything.[2]
A shared root cause, and prior related findings
Accomplish AI describes both bugs as sharing one shape: the mechanism doing the enforcement was running inside the thing it was meant to enforce. `apply_patch` worked out its own write permissions from input the agent supplied; `node_repl` kept the secret separating trusted from untrusted code inside the same memory the untrusted code could read.[1]
BleepingComputer notes this class of bug is not new to Codex specifically. In July 2026, Pillar Security researchers reported the same underlying pattern across Cursor, Codex, Gemini CLI and Google’s Antigravity, where an agent operating inside its sandbox writes a file that a trusted tool outside the sandbox later runs.[2]
Fixed versions and current status
OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0, according to Accomplish AI.[2] Yomtov credited OpenAI with resolving both issues within eight days of his report, submitted 12 August 2026.[1][2] In its statement to BleepingComputer, OpenAI said it addressed both issues in August and continues to strengthen its sandboxes, citing recent updates that tighten controls on where agents can write files and expand testing of those protections across platforms.[2]
Users of Codex Desktop or Codex CLI on a version older than the fixed builds remain exposed to the reported techniques; updating to the fixed builds or later removes the specific mechanisms the researchers describe. Neither source states an exploitation timeline outside the disclosure process itself, and the article’s own review of these two reports found no claim that either technique was used against a production system before the fix.
Sources
[1] Escaping the OpenAI Codex sandbox, twice
[2] Researchers escape OpenAI Codex sandbox to run commands on host
read0nly 