Heapjack and Overpatch: OpenAI Codex sandbox escapes patched in 8 days

Opening a malicious repository in OpenAI Codex was enough to escape its sandbox and run commands on your machine, even in the strictest read-only mode. Two vulnerabilities, Heapjack and Overpatch, let untrusted code break the isolation boundary and execute arbitrary actions on the host. OpenAI fixed both within eight days of the report, but the episodes reveal a fundamental design problem: the sandbox's enforcement logic lived inside the very memory and tools it was supposed to constrain.

Heapjack: shared heap, stolen token

Heapjack targets Codex Desktop's node_repl component, which runs a single Node.js process with two JavaScript contexts: one trusted with OpenAI's code, and one untrusted running the agent's code. The trusted context authenticates itself via a random token generated each run. The problem is that both contexts share the same V8 memory heap, so the token is just a string sitting in memory the untrusted side can read.

The exploit uses v8.getHeapSnapshot() to dump the heap, scans for UUID-looking strings, and tries each against the validation endpoint. A correct token plus a valid argument lets the untrusted code write its own requests onto the pipe used by the trusted context to talk to the native parent process. The parent sees a valid token and executes the command, launching external processes or even accessing the Docker daemon -- all without any approval prompt. The vulnerability works in the read-only sandbox mode, where the agent is not supposed to write anything at all.

Overpatch: abusing apply_patch

Overpatch lives in the open-source Codex CLI. In workspace-write mode, the agent can only write inside the project folder. But Codex's own apply_patch tool grants write permission to the parent folder of each path named in a patch. By including a path like /tmp, the attacker widens permissions to the entire filesystem root. A second patch then appends a malicious line to .zshrc through a symlink. The next terminal session runs the injected code unsandboxed.

Why this matters for AI builders

Both flaws share a pattern: the enforcement mechanism trusted attacker-controlled input to determine its own boundaries. The token was stored in shared memory, and apply_patch derived its own permissions from paths in the patch. This class of sandbox escape is not new -- Pillar Security demonstrated similar attacks on Cursor, Codex, Gemini CLI, and Google's Antigravity in July 2026. For teams building AI-assisted development workflows, the takeaway is that sandboxes are only as strong as their internal assumptions. The node_repl component is enabled by default with no opt-in or disable switch, affecting plain CLI users who never consented to running an additional tool.

Update now

OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0. Users should update to these or newer versions. The researchers at Accomplish AI credited OpenAI with resolving both issues within eight days of the August 12 disclosure. There is no known workaround beyond updating, making this a must-patch for any developer using Codex.

Design lessons

The root cause is architectural. As one commenter put it, "V8 contexts isolate globals, not memory, so the sandbox was really a promise the heap never agreed to." Enforcement boundaries that live inside the process they constrain are fragile. For builders deploying coding agents at scale, this reinforces the value of defense-in-depth: use OS-level sandboxing, limit network access, and run agent processes with the minimum necessary permissions. A single Node.js process should never be the only barrier between untrusted code and the host.