Researchers escape OpenAI Codex sandbox to run commands on host

Summary

Researchers at Accomplish AI disclosed two sandbox-escape vulnerabilities in OpenAI's Codex coding agent. The more serious, dubbed Heapjack, turns opening and questioning someone else's repository into unsandboxed remote code execution on the developer's machine, with no approval prompt and nothing shown on screen, even in Codex's strictest read-only mode.^[0]

Both flaws were reported to OpenAI on August 12, 2026 and resolved within eight days. There is no evidence of in-the-wild exploitation; the work is proof-of-concept vulnerability research, with fixes shipped in Codex Desktop build 26.818.21641 and Codex CLI 0.149.0.^[0]

Attack chain

1. Delivery: A victim opens an attacker-controlled repository in Codex and asks the agent a question about the code, triggering execution of the attacker's content inside the sandbox.^[0]
2. Token theft: Untrusted agent code takes a heap snapshot via v8.getHeapSnapshot() and brute-forces UUID-shaped strings; a correct token with a bad argument returns a validation error, confirming the authorization token.^[0]
3. Privilege escalation / escape: With the stolen token, the untrusted code writes its own request onto the pipe the trusted context uses to reach a native, unsandboxed parent process, which validates the token and performs the requested work outside the sandbox.^[0]
4. Execution on host: The proof of concept used the system 'open' command to launch an application outside Codex's process tree; the same access reaches any Unix socket (e.g. a Docker daemon socket) and the global config editor, all from read-only mode.^[0]

Disclosure timeline

How it works

Heapjack exploits node_repl, a component Codex Desktop writes into the shared global ~/.codex/config.toml at install with no opt-in, so Codex CLI users inherit it too. node_repl runs a single Node.js process holding two JavaScript contexts: a trusted context with OpenAI's code and an untrusted context running agent code. The trusted context authenticates using a random per-run token, but because both contexts share one memory heap, the untrusted side can read that token as a plain string in memory.^[0]

The untrusted code snapshots the heap with v8.getHeapSnapshot() and tries every UUID-shaped string; a wrong guess returns 'not authorized' while a correct token with a bad argument returns a real validation error, revealing the valid token. It then writes its own request onto the pipe the trusted context uses to talk to a native unsandboxed parent process, which validates the token and executes the work outside the sandbox, even in strict read-only mode.^[0]

Overpatch abuses the open-source Codex CLI's apply_patch tool. apply_patch grants write access to the parent folder of each path named in a patch, so naming '/tmp' grants write access to the root of the disk. The working exploit combines two changes: one naming '/tmp' to widen the permission, and one appending a line to '.zshrc' via a symlink into the home directory. Removing the first change causes the write to be refused; with it, the next terminal the developer opens runs the attacker's line unsandboxed.^[0]

Both bugs share the same underlying mistake: the enforcement mechanism lived inside the thing it was enforcing. apply_patch derived its own permissions from attacker-supplied input, and node_repl kept the trust-separating secret in the same memory as the untrusted code, so in each case the sandbox was told from the inside to let something through.^[0]

Affected versions and patch status

Key takeaways

• Sandbox boundaries fail when the enforcement mechanism runs inside the untrusted context it is supposed to police: Codex's authorization token sat in a heap shared with untrusted code, and apply_patch derived its permissions from attacker-supplied input.^[0]
• AI coding-agent sandbox escapes are a recurring class of bug, previously demonstrated by Pillar Security in July 2026 across Cursor, Codex, Gemini CLI and Google's Antigravity, where in-sandbox code writes a file that a trusted out-of-sandbox tool later runs.^[0]
• Default-enabled, opt-out-less features like node_repl written into a shared global config expand the attack surface for all users, including CLI users who were never asked, and made a privileged token reachable from untrusted JavaScript.^[0]

Defensive actions

• Update OpenAI Codex Desktop to build 26.818.21641 or later and Codex CLI to 0.149.0 or later.: These versions contain OpenAI's fixes for Heapjack and Overpatch respectively; earlier versions remain vulnerable to sandbox escape.^[0]
• Treat opening and querying untrusted third-party repositories in Codex as a code-execution risk.: Heapjack turns opening someone else's repository and asking a question about the code into unsandboxed command execution on the developer's host, with no prompt and nothing shown on screen.^[0]