Security researchers have successfully identified and exploited two distinct sandbox escape vulnerabilities within OpenAI Codex, highlighting critical trust-boundary weaknesses in AI-driven development tools. The flaws, reported to OpenAI on August 12 by Oren Yomtov of Accomplish AI, allowed unauthorized command execution on host machines directly from the strictest sandbox modes without triggering approval prompts.
The more critical vulnerability, designated as Heapjack, transforms a routine repository inspection into remote code execution. By opening an unverified repository within Codex and executing a query, an attacker can compromise a developer’s local machine. The flaw targets the node_repl component installed automatically via the global ~/.codex/config.toml configuration file in Codex Desktop, which is also inherited by standard Codex CLI installations without explicit user opt-in.
The architectural root of Heapjack lies in a shared memory heap within a single Node.js process managed by node_repl. This process runs both a trusted context containing OpenAI’s internal code and an untrusted context executing agent routines, separated only by a random UUID validation token. Because both contexts share the same V8 memory heap, untrusted code can extract the validation token using v8.getHeapSnapshot(), bypass access restrictions, and issue malicious commands to the native parent process.
The second vulnerability, named Overpatch, affects the open-source Codex CLI workspace-write mechanism. Researchers discovered that the built-in patch utility, apply_patch, incorrectly calculates file write permissions by relying on attacker-supplied directory arguments. By referencing restricted paths such as /tmp alongside a symlink directed at the user’s home directory, an attacker can append persistent execution vectors into shell configuration files like .zshrc.
OpenAI responded swiftly to the disclosures, patching Heapjack in Codex Desktop build 26.818.21641 and resolving Overpatch in Codex CLI version 0.149.0 within an eight-day window. Enterprises and individual developers utilizing these AI coding agents are urged to apply the latest updates immediately to mitigate potential host compromise.