Security researcher Oren Yomtov of Accomplish AI found two ways to break out of OpenAI Codex’s sandbox and run arbitrary commands on a developer’s machine. Both flaws were reported to OpenAI on August 12 and fixed within eight days.
The more serious technique, which Yomtov named Heapjack, targets a component called node_repl that Codex Desktop quietly installs into a global config file at setup — with no opt-in and no setting to disable it. The component runs trusted and untrusted JavaScript contexts inside the same Node.js process, which means they share one V8 memory heap. The trusted context proves its identity to a native parent process using a random token, but because both contexts share the heap, the untrusted side can call v8.getHeapSnapshot() and scan for strings shaped like UUIDs until it finds the real one. Armed with the token, the untrusted code issues privileged commands through the parent process — including running shell commands, targeting a Docker socket, or editing the global config. Critically, this works in Codex’s read-only sandbox mode, the strictest setting, where the agent is supposed to write nothing at all. An attacker could embed a malicious repository, wait for a developer to open it in Codex, and get unsandboxed execution on that developer’s machine without any visible prompt.
The second technique, Overpatch, is in the open-source Codex CLI. When in workspace-write mode, the agent’s apply_patch tool is only supposed to write inside the project folder. The flaw: the tool grants write access to the parent folder of any path named in a patch diff. Name /tmp, and it grants write access to the entire disk. The working exploit pairs two changes: one that names /tmp to expand the write permission, and one that appends a line to .zshrc through a symlink into the home directory. Remove the first change and the write is blocked; include it, and the next terminal session the developer opens runs the attacker’s command unsandboxed.
Both bugs share the same underlying mistake: the enforcement mechanism lived inside the thing it was enforcing. Yomtov credited OpenAI with resolving both issues within eight days of his report; BleepingComputer confirmed they reached out to OpenAI before publishing.
How to check if you’re affected
Affected versions are Codex Desktop builds earlier than 26.818.21641 and Codex CLI versions older than 0.149.0. Check your installed Codex CLI version with codex --version and update via your package manager or npm. Codex Desktop users should let the app auto-update or reinstall from OpenAI’s site.