Two Bugs in OpenAI Codex Break the Strictest Sandbox in…

Oren Yomtov of Accomplish AI discovered and demonstrated two sandbox-escape vulnerabilities in OpenAI Codex — Heapjack and Overpatch — that allow unsandboxed command execution on the user's host machine, even in the most restrictive read-only mode. Both were reported on August 12, 2026 and patched by OpenAI within eight days.

Key Takeaways

Heapjack exploits shared V8 heap memory between trusted and untrusted contexts in Codex Desktop to extract the authentication token and impersonate the unsandboxed native parent process.
The attack triggers when a user opens a third-party repository in Codex — a routine developer action — requiring no user interaction or approval.
Overpatch bypasses Codex CLI's workspace-write restrictions by manipulating permissions derived from the parent folder in patch paths, enabling arbitrary writes up to the disk root.
The _node_repl_ component enabling Heapjack is active by default with no opt-in and no disable option; CLI users inherit the same tool via the shared config file.

Heapjack: When Shared Heap Eats the Trust Boundary

The Heapjack mechanism nests in the _node_repl_ component that Codex Desktop registers in the global ~/.codex/config.toml file. This component runs trusted and untrusted code inside the same Node.js process, sharing the same V8 heap memory. The isolation promise dissolves here: V8 contexts isolate globals, not the underlying memory.

The trusted authorization token resides in this shared memory as a readable string. Untrusted code extracts it via v8.getHeapSnapshot(), then validates it by brute force: a "not authorized" response indicates a wrong token, while a genuine validation error on a malformed argument confirms the correct token. With this credential, untrusted code writes requests on the same pipe the trusted context uses to communicate with the native parent process — completely outside the sandbox.

Yomtov's proof-of-concept used the system open command to launch an application outside the Codex process tree, with potential access to any Unix socket including the Docker daemon socket. According to BleepingComputer, all of this occurs in read-only mode, "the strictest sandbox mode, where the agent is not supposed to write anything at all."

Overpatch: The Path That Tricks Permissions

The second vulnerability resides in the open-source Codex CLI and affects the apply_patch tool. The enforcement mechanism derives write permissions from the parent folder of each path named in a patch: naming /tmp extends write permissions up to the disk root, bypassing workspace-write restrictions.

The exploit demonstrated by Yomtov combines two modifications in a single patch: one that names /tmp to widen write permissions, and one that appends a line to .zshrc in the user's home directory, reachable via symlink. The result is persistent code execution with the privileges of the user running Codex CLI.

The Common Structure: The Guard That Guards Itself

"In each case the sandbox was told, from the inside, to let something through." — BleepingComputer

Both bugs share an identical architectural form: the enforcement mechanism lives inside what it should control. In Heapjack, the _node_repl_ component managing the trust boundary runs in the same memory space as untrusted code. In Overpatch, the apply_patch tool that should limit writing derives its own permissions from input potentially manipulated by the attacker.

A commenter on X, cited by BleepingComputer, captured the problem with a precise metaphor: the trust boundary is "a room divider" — a partition, not a wall. A second quote reported by the outlet reinforces the point: "V8 contexts isolate globals, not memory, so the sandbox was really a promise the heap never agreed to."

This structure — the control nested inside the controlled object — is not an isolated implementation error but a design problem spanning both vulnerabilities. The _node_repl_ component is enabled by default with no opt-in and no setting to disable it; because the entry sits in the shared config file, even CLI-only users inherit the same tool without ever being informed.

Timeline and Fixes: Eight Days from Report to Patch

According to Oren Yomtov of Accomplish AI, both vulnerabilities were reported to OpenAI on August 12, 2026. The response came within eight days: OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI version 0.149.0.

The speed of response does not erase the exposed attack surface. The dossier does not document whether OpenAI published an official advisory beyond the silent fixes, nor how many users are actually affected by the _node_repl_ component enabled by default. No infrastructure overlaps emerge linking these vulnerabilities to in-the-wild exploits beyond the researchers' proof-of-concepts.

What to Do Now

Update Codex Desktop immediately to build 26.818.21641 or later to mitigate Heapjack.
Update Codex CLI to version 0.149.0 or later to mitigate Overpatch.
Check for the _node_repl_ component in ~/.codex/config.toml and assess whether your installation is affected.
Re-evaluate opening third-party repositories in Codex Desktop without prior code audit, given the automatic activation of the vulnerable component.

The Systemic Problem of AI Agents Policing Themselves

Heapjack and Overpatch are not isolated product flaws. They fit into a research thread mapping the structural fragility of AI coding agents. In July 2026, Pillar Security had already demonstrated indirect attack techniques on Cursor, Codex CLI, Gemini CLI, and Antigravity, exploiting agent-generated files to manipulate subsequent behavior. In August 2026, Yomtov himself discovered separate vulnerabilities in Docker Sandboxes (CVE-2026-77179 and CVE-2026-79994, as reported by The Hacker News), showing the problem crosses product boundaries.

The takeaway is this: AI agents that execute code require sandboxes that do not share memory resources with untrusted code, and enforcement mechanisms that do not derive their permissions from attacker-controlled input. As long as isolation architecture rests on promises that hardware and operating systems cannot honor, every sandbox will be a movable partition, not an escape-proof cell.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter