Researchers escape OpenAI Codex sandbox to run commands on host

Researchers disclosed two OpenAI Codex sandbox escape vulnerabilities, Heapjack and Overpatch, enabling unsandboxed command execution on developer machines via malicious repositories; OpenAI fixed both within about a week.

Oren Yomtov of Accomplish AI reported two sandbox escape vulnerabilities in OpenAI Codex on August 12, 2026, which OpenAI fixed within eight days (one report says within a week) in Codex Desktop 26.818.21641 and Codex CLI 0.149.0. Heapjack targets the node_repl component in Codex Desktop, which is enabled by default in ~/.codex/config.toml with no opt-out for CLI users: its trusted and untrusted JavaScript contexts share a single Node.js memory heap, so untrusted code can dump the heap with v8.getHeapSnapshot(), brute-force the trusted context's UUID token, and issue unsandboxed commands in read-only mode, including reaching Unix sockets such as the Docker daemon and modifying global Codex configuration, with no approval prompts required. Overpatch abuses the Codex CLI's apply_patch tool, which grants write access to parent directories of patch paths; naming /tmp widens permissions to disk-root write access, allowing a malicious line to be appended to .zshrc via a symlink into the home directory for persistence. Both attacks can trigger when a developer opens an attacker's repository and asks Codex about the code. No in-the-wild exploitation was observed. Users should update to Codex CLI 0.149.0+ and Codex Desktop 26.818.21641+.

• Two sandbox escape vulnerabilities, Heapjack and Overpatch, were reported by Oren Yomtov of Accomplish AI on August 12, 2026.
• Heapjack targets the node_repl component in Codex Desktop, whose trusted and untrusted JavaScript contexts share one Node.js V8 memory heap.
• Untrusted code can dump the shared heap with v8.getHeapSnapshot() and brute-force the trusted context's UUID token to issue unsandboxed commands.
• Heapjack works in read-only sandbox mode without approval prompts and can reach Unix sockets such as the Docker daemon and modify global Codex configuration.
• Overpatch abuses the Codex CLI's apply_patch tool, which grants write access to parent directories of patch paths; naming /tmp grants disk-root write access.
• Overpatch can append a malicious line to .zshrc via a symlink into the home directory for persistence.
• Both attacks can trigger when a developer opens an attacker's repository and asks Codex about the code.
• node_repl is enabled by default in ~/.codex/config.toml with no opt-out for CLI users.