Artificial Intelligence
OpenAI Codex sandbox escapes let commands run on host
Researchers found two ways out of OpenAI Codex’s sandbox, including one that could trigger host commands from read-only mode, and OpenAI patched both within eight days of being told.
- Researchers found two ways out of the OpenAI Codex sandbox, including one that could run commands on a developer’s machine from the most restricted mode.
- Oren Yomtov of Accomplish AI said both flaws were reported to OpenAI on 12 August and fixed within eight days.
- OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0.
- The Heapjack issue involved node_repl in Codex Desktop, while Overpatch abused apply_patch in the open-source Codex CLI.
Security researchers found two sandbox escapes in OpenAI Codex. Oren Yomtov of Accomplish AI said the issues were reported on 12 August and fixed within eight days.
Heapjack affected a component called node_repl that Codex Desktop wrote into ~/.codex/config.toml at install time. Yomtov said untrusted code in the same Node process could read a token from memory and then send a request to the parent process.
In the proof of concept, the researchers used the system open command to launch software outside Codex’s process tree. They said the same route could reach Unix sockets, including a Docker daemon socket, and tools that edit the global config file.
Overpatch affected the open-source Codex CLI in workspace-write mode. Yomtov said apply_patch could be made to write outside the project folder by naming /tmp in a patch and then using a symlink to append to .zshrc in the home directory.
OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0, according to Accomplish AI. Yomtov said users should update to those versions or later.
Named in this story
People
- Oren Yomtov
- reported the flaws and described the attacks
Companies
- OpenAI
- made Codex and patched both flaws
- Accomplish AI
- Yomtov’s employer and the source of the writeup
- Pillar Security
- had researchers who showed the same idea across other agents in July 2026
Products and systems
- Codex
- the coding agent that researchers escaped from
- Codex Desktop
- wrote node_repl into the user config and received the Heapjack fix
- Codex CLI
- inherited node_repl and received the Overpatch fix
- node_repl
- the component used in the Heapjack escape
- apply_patch
- the patch tool abused in the Overpatch escape
- Cursor
- one of the agents named in the earlier demonstration
- Gemini CLI
- one of the agents named in the earlier demonstration
- Google's Antigravity
- one of the agents named in the earlier demonstration
How the source tells it
The article is a technical security report with mild alarm in its escape descriptions and an advisory close that names fixes and urges updates.
- alarm a sandbox escape is framed as host-level command execution from the most restricted mode
- urgency the piece ends by naming fixed versions and telling users to update