Security researchers found two ways out of the OpenAI Codex sandbox. One of these methods can run commands on a developer machine from Codex in its strictest mode. This happens with no approval prompt and nothing shown on screen.
Oren Yomtov of Accomplish AI reported both flaws to OpenAI on August 12. OpenAI fixed the issues within eight days.
The more serious flaw is called Heapjack. It turns a routine action into remote code execution. If you open an untrusted repository in Codex and ask a question about the code, the repository writer gets unsandboxed command execution on your computer.
Codex is an OpenAI coding agent available as a desktop app and a command-line tool. It runs model actions inside a sandbox to prevent untrusted code from touching the wider system. Both escapes defeat that boundary from the inside.
Heapjack targets a component called node_repl. Codex Desktop writes this component into the global config file during installation. There is no opt-in and no setting to turn it off. Plain Codex CLI users inherit the same tool automatically.
The node_repl component runs a single Node.js process with two JavaScript execution contexts. One is trusted and holds OpenAI code. The other is untrusted and runs agent code. A random token generated fresh on each run proves the trusted context is legitimate.
Both contexts share one memory heap inside a single Node process. Because of this, the token sits as a string in memory that the untrusted side can read. The untrusted code takes a heap snapshot and tests strings shaped like a UUID. A wrong guess returns not authorized, while a correct token with a bad argument returns a validation error.
Once the untrusted code has the token, it writes requests onto the same pipe the trusted context uses. The parent process checks the token and executes the work. The proof of concept used the system open command to launch an application outside the Codex process tree.
The second flaw is called Overpatch and affects the open-source Codex CLI. In workspace-write mode, the agent should only write inside the project folder, and shell commands aimed at the home directory are refused. Researchers bypassed this using the apply_patch tool.
The tool grants write access to the parent folder of each path named in a patch. Naming a temporary folder grants write access to the root of the disk. A working exploit used a patch with two changes to append a line to a zshrc file through a symlink.
Both bugs share a common shape. The enforcement mechanism lived inside the thing it was supposed to enforce. In July 2026, Pillar Security researchers demonstrated a similar idea across Cursor, Codex, Gemini CLI, and Google Antigravity.
OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0. Users should update to those versions or later.
