Researchers escape OpenAI Codex sandbox to run commands on host
Summary
Researchers reported two sandbox-escape flaws in OpenAI Codex that could allow untrusted repository content or agent actions to execute commands outside Codex's sandbox. Accomplish AI researcher Oren Yomtov reported the issues to OpenAI on 2026-08-12; OpenAI reportedly fixed them within eight days.
Key points
- Heapjack affected Codex Desktop's default-enabled node_repl component and could enable unsandboxed command execution when a user opens an attacker-controlled repository and asks Codex about its code.
- Heapjack abused shared memory between trusted and untrusted JavaScript contexts in one Node.js process to recover a trusted token from a V8 heap snapshot and send requests to an unsandboxed native parent process.
- The Heapjack proof of concept used the system open command to launch an application outside Codex's process tree; the researchers said the access could also reach Unix sockets, including a Docker daemon socket.
- Overpatch affected the open-source Codex CLI in workspace-write mode. Its apply_patch tool could be abused to grant write access beyond the project folder by naming /tmp in a patch.
- The Overpatch exploit used a symlink to append a line to .zshrc, causing the attacker's command to run unsandboxed when the developer next opened a terminal.
- Accomplish stated that Heapjack was fixed in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0. Users should update to these versions or later.
Tags
Sandbox EscapeRemote Code ExecutionAI Coding Agent SecurityDeveloper Workstation SecurityPrivilege Boundary Bypass
MITRE ATT&CK
T1059Heapjack could cause commands to execute outside the Codex sandbox, and the Overpatch proof of concept appended an attacker's line to .zshrc for execution when a terminal opened.T1546.004The Overpatch exploit appended a line to .zshrc through a symlink so it would run when the developer opened a new terminal.