Security researchers from **Accomplish AI**, led by **Oren Yomtov**, have detailed two critical sandbox escape vulnerabilities in **OpenAI's** **Codex**—its AI-powered coding agent. These flaws, named 'Heapjack' and 'Overpatch', could allow untrusted code to execute commands outside the agent's intended isolation. Both vulnerabilities were responsibly disclosed to **OpenAI** on August 12 and were promptly patched within eight days, according to **Yomtov**. ### Heapjack: Unsanctioned Command Execution The more severe of the two, 'Heapjack', transforms a seemingly innocuous action into a remote code execution exploit. By simply opening a malicious repository in **Codex** and querying its code, an attacker could gain unsandboxed command execution on the user's computer. **Codex**, available as both a command-line tool and a desktop application, utilizes a sandbox to contain untrusted code and prevent it from interacting with the wider system. 'Heapjack' circumvents this boundary from within. The technique targets a component called `node_repl`, which **Codex Desktop** writes into the global `~/.codex/config.toml` file during installation. This component is enabled by default, without an opt-in or an option to disable it, and is inherited by **Codex CLI** users. `node_repl` operates a single **Node.js** process containing two distinct **JavaScript** execution contexts: one trusted (for **OpenAI's** code) and one untrusted (for the agent's code). The trusted context authenticates itself using a random token generated per run.  The core vulnerability lies in the fact that both contexts share a single **Node** process and memory heap. This allows the untrusted code to access the trusted context's token, which is merely a string in memory. Attackers can take a heap snapshot using `v8.getHeapSnapshot()` and brute-force strings resembling a UUID. A correct token, even with a malformed argument, triggers a specific validation error, confirming the token's validity. With the token, the untrusted code can inject its own requests into the communication pipe used by the trusted context to interact with an unsandboxed parent process. The parent process, validating the token, then executes the attacker's command. A proof-of-concept demonstrated using the system's `open` command to launch an application outside **Codex's** process tree. This level of access could potentially target **Unix** sockets, including **Docker** daemon sockets, or modify the global config file. Crucially, this exploit functions even in **Codex's** strictest 'read-only' sandbox mode, where the agent is not supposed to perform any write operations. ### Overpatch: Circumventing Write Restrictions The second flaw, 'Overpatch', affects the open-source **Codex CLI**. In 'workspace-write' mode, the agent is designed to only write within the project folder, explicitly denying shell commands targeting the home directory. Researchers exploited **Codex's** own `apply_patch` tool to bypass this restriction. The `apply_patch` tool grants write access to the parent folder of any path named within a patch. Naming `/tmp` in a patch, for instance, would grant write access to the root of the disk. The exploit involved a patch with two changes: one that named `/tmp` (without a functional purpose other than widening permissions) and another that appended a line to `.zshrc` via a symlink into the home directory. Without the `/tmp` change, the write operation would be refused. With it, the next terminal session opened by the developer would execute the attacker's line unsandboxed. ### A Common Security Oversight Both 'Heapjack' and 'Overpatch' stem from a similar design flaw: the enforcement mechanism resided within the very component it was meant to enforce. `apply_patch` derived its permissions from attacker-controlled input, while `node_repl` stored the secret separating trusted from untrusted code in the same memory space as the untrusted code. This class of vulnerability, where the sandbox is internally instructed to permit an action, is not new. In July 2026, **Pillar Security** researchers demonstrated similar sandbox escapes across **Cursor**, **Codex**, **Gemini CLI**, and **Google's Antigravity**, where an agent within its sandbox writes a file that a trusted external tool later executes. Industry experts reacting to **Yomtov's** post on X highlighted the fundamental issues. One commenter noted, "V8 contexts isolate globals, not memory, so the sandbox was really a promise the heap never agreed to." Another critically questioned why a privileged token was accessible from untrusted **JavaScript** at all. ### Remediation and Recommendations **OpenAI** addressed 'Heapjack' in **Codex Desktop** build 26.818.21641 and 'Overpatch' in **Codex CLI** 0.149.0. Users are strongly advised to update to these versions or later. An **OpenAI** spokesperson thanked the researchers, stating, "We addressed both issues in August, but we’re continually strengthening our sandboxes, with recent updates that tighten controls on where agents can write files and expand testing of those protections across platforms." These findings underscore the critical need for robust, externalized security boundaries in AI development tools, particularly as these agents gain more sophisticated capabilities and access to developer environments.