OpenAI Codex Sandbox Flaws Let Malicious Repositories Execute Commands on Host Systems
Two OpenAI Codex sandbox flaws, Overpatch and Heapjack, let malicious repositories execute unsandboxed commands on developer hosts; both are patched.
Researchers reported two vulnerabilities in OpenAI Codex on August 12, 2026, which OpenAI fixed within a week. Overpatch, in the Codex CLI apply_patch tool, let attacker-controlled paths like /tmp widen file-write permissions beyond the workspace, enabling persistence via a modified .zshrc. Heapjack, in Codex Desktop's node_repl tool, exposed a trusted authorization token in a shared V8 heap, allowing forged requests to launch unsandboxed host commands. Fixes shipped in Codex CLI 0.149.0 and Codex Desktop 26.818.21641.
- Overpatch abused attacker-supplied patch paths to escape Codex CLI workspace-write sandbox restrictions.
- Heapjack recovered a trusted token via V8 heap snapshot to forge unsandboxed command execution requests.
- Forged requests could reach the Docker daemon socket and modify global Codex configuration.
- No approval prompts were required, even in read-only sandbox mode.
- Users should update to Codex CLI 0.149.0+ and Desktop 26.818.21641+.
- Vendors
- OpenAI
- Products
- Codex CLICodex Desktop
- Organizations
- OpenAI
- AI models
- OpenAI Codex
From the original article
3 min read at cybersecuritynews.com
OpenAI Codex recently faced two significant security vulnerabilities that allowed malicious repositories to potentially execute commands on a developer’s local system. These vulnerabilities, identified as Overpatch and Heapjack, were reported to OpenAI on August 12, 2026, and were addressed in under a week. The more critical issue, Heapjack, emerged when a developer accessed an attacker-controlled […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.