OpenAI Codex Sandbox Escapes — Two Flaws Let Attackers Run Commands on Developer Machines

How Did Researchers Escape the OpenAI Codex Sandbox?

Coding agents that write and run code on your behalf rely on sandboxes to keep untrusted operations contained. When those boundaries fail, the consequences can be severe. Security researchers at Accomplish AI discovered two separate sandbox escape vulnerabilities in OpenAI's Codex agent, as reported by BleepingComputer. One of them achieved remote code execution on a developer's machine from the tool's most restrictive read-only mode, with no approval prompt and nothing visible on screen.

Both flaws were reported to OpenAI on 12 August 2026 and patched within eight days. OpenAI released fixes in Codex Desktop build 26.818.21641 and Codex CLI version 0.149.0.

Heapjack — Remote Code Execution From Read-Only Mode

The more critical vulnerability, dubbed Heapjack by researcher Oren Yomtov, targets a component called node_repl. This tool runs a single Node.js process containing two JavaScript execution contexts: a trusted one holding OpenAI's own code and an untrusted one running the agent's generated code. The trusted context authenticates itself using a randomly generated token created fresh on each run.

The fundamental problem is that both contexts share one memory heap. The untrusted code can take a snapshot of the heap, scan it for UUID-shaped strings and test each one. A wrong token returns a "not authorized" error, while a correct token with a bad argument returns a different validation error, confirming the match.

Once the attacker has the valid token, they can write requests onto the same pipe the trusted context uses to communicate with an unsandboxed parent process. The parent checks the token, sees it is valid and executes the command. The proof of concept used the system's open command to launch applications entirely outside the Codex process tree.

This attack works at read-only mode, the strictest sandbox setting where the agent is not supposed to write anything at all.

Overpatch — Escaping Write Restrictions Through the Patch Tool

The second flaw sits in the open-source Codex CLI. In workspace-write mode, the agent is only allowed to modify files inside the project folder. A shell command targeting the home directory gets refused.

Researchers found that Codex's own apply_patch tool grants write access to the parent folder of each path named in a patch. By naming /tmp, the tool inadvertently grants write access to the root of the disk. The working exploit uses a two-part patch: one change names /tmp to widen permissions, and another appends a malicious line to the shell configuration file through a symlink into the home directory. The next time a developer opens a terminal, the injected code runs unsandboxed.

A Pattern Across Coding Agents

Both Codex vulnerabilities share a common structural weakness: the enforcement mechanism lives inside the thing it is supposed to enforce. The apply_patch tool determines its own permissions from attacker-supplied input. The node_repl component stores its authentication secret in memory accessible to the code it is meant to restrict.

This pattern is not unique to Codex. In July 2026, researchers at Pillar Security demonstrated similar sandbox escapes across Cursor, Codex, Gemini CLI and Google's Antigravity, where an agent writes a file inside the sandbox that a trusted tool outside the sandbox later executes. The broader lesson is that coding agents across the industry face the same fundamental challenge: keeping untrusted code truly isolated while still letting it do useful work.

What Developers and Security Teams Should Do

• Update immediately — ensure Codex Desktop is at build 26.818.21641 or later and Codex CLI is at version 0.149.0 or later
• Review sandbox policies — audit how any coding agent interacts with your development environment, particularly its access to shell configurations and system-level APIs
• Treat coding agents as attack surface — when opening untrusted repositories in any coding agent, treat them with the same caution as running untrusted executables
• Monitor for similar disclosures — sandbox escape research is accelerating across the coding agent ecosystem, and vendors are actively patching

Frequently Asked Questions

What is the OpenAI Codex Heapjack vulnerability?

Heapjack is a sandbox escape that exploits shared memory between trusted and untrusted JavaScript contexts in Codex's node_repl component. It allows remote code execution even in read-only mode. OpenAI patched it in August 2026.

Are other coding agents affected by similar flaws?

Yes. In July 2026, Pillar Security researchers demonstrated comparable sandbox escapes across Cursor, Codex, Gemini CLI and Google's Antigravity. The pattern of enforcement mechanisms living inside the thing they enforce is a widespread architectural challenge.

How can I protect myself from coding agent sandbox escapes?

Update your coding tools to the latest versions, avoid opening untrusted repositories without review, and monitor security advisories for the tools you use. Consider running coding agents in isolated virtual environments for sensitive projects.

Has OpenAI fixed both Codex vulnerabilities?

Yes. Both Heapjack and Overpatch were reported on 12 August 2026 and fixed within eight days. Updates are available in Codex Desktop build 26.818.21641 and Codex CLI 0.149.0.

Should businesses restrict coding agent usage after these findings?

Businesses should not ban coding agents outright but should establish usage policies that include keeping tools updated, restricting access to sensitive repositories and conducting regular security reviews of development toolchains.