Codex Desktop (Product): news timeline & CVEs

OpenAI Codex Sandbox Flaws Let Malicious Repositories Execute Commands on Host Systems

Two OpenAI Codex sandbox flaws, Overpatch and Heapjack, let malicious repositories execute unsandboxed commands on developer hosts; both are patched.

Researchers reported two vulnerabilities in OpenAI Codex on August 12, 2026, which OpenAI fixed within a week. Overpatch, in the Codex CLI apply_patch tool, let attacker-controlled paths like /tmp widen file-write permissions beyond the workspace, enabling persistence via a modified .zshrc. Heapjack, in Codex Desktop's node_repl tool, exposed a trusted authorization token in a shared V8 heap, allowing forged requests to launch unsandboxed host commands. Fixes shipped in Codex CLI 0.149.0 and Codex Desktop 26.818.21641.

Cyber Security NewsSep 21, 08:08 UTC · 6d agoAI safety & security 2 sources

Researchers escape OpenAI Codex sandbox to run commands on host

Researchers found two OpenAI Codex sandbox escapes, including Heapjack, enabling unsandboxed command execution on developer machines; OpenAI fixed both within eight days.

Oren Yomtov of Accomplish AI reported two sandbox escapes in OpenAI Codex on August 12, fixed within eight days in Codex Desktop 26.818.21641 and Codex CLI 0.149.0. Heapjack targets the default-enabled node_repl component in Codex Desktop, whose trusted and untrusted JavaScript contexts share one Node.js memory heap, letting untrusted code dump the heap with v8.getHeapSnapshot(), brute-force the trusted context's UUID token, and issue unsandboxed commands in read-only mode, including reaching Unix sockets like the Docker daemon. Overpatch abuses the Codex CLI's apply_patch tool, which grants write access to parent directories of patch paths, so naming /tmp widens permissions enough to append a malicious line to .zshrc via a symlink into the home directory. Both attacks can trigger when a developer opens an attacker's repository and asks Codex about the code; no in-the-wild exploitation was reported.

BleepingComputerupdated Sep 21, 08:08 UTC · 6d agofirst Sep 20, 12:00 UTC · 6d agoAI safety & security 2 sources

Codex Desktop

Timeline2 articles

Appears with

OpenAI Codex Sandbox Flaws Let Malicious Repositories Execute Commands on Host Systems

Researchers escape OpenAI Codex sandbox to run commands on host