Researchers Break Out of OpenAI Codex Sandbox to Reach the Host

Security researchers uncovered two separate ways to break out of OpenAI Codex’s sandbox, including one that achieves unsandboxed remote code execution even in the tool’s most restrictive mode, with no approval prompt and no visible warning. Both issues were reported to OpenAI on August 12 by Oren Yomtov of Accomplish AI and fixed within eight days.

Heapjack

The more serious flaw, dubbed Heapjack, targets node_repl, a component Codex Desktop installs by default into the shared ~/.codex/config.toml file, with no opt-in and no way to disable it. Because the entry lives in the shared config, Codex CLI users inherit the same exposure.

node_repl runs a single Node.js process containing two JavaScript execution contexts, one trusted with OpenAI’s own code and one untrusted running the agent’s code. The trusted side proves its identity with a random token generated at runtime, but since both contexts share the same memory heap, the untrusted code can dump a heap snapshot with v8.getHeapSnapshot() and brute-force UUID-shaped strings until it finds the valid token.

With a valid token, the untrusted context can send its own requests over the same pipe the trusted context uses to reach a native, unsandboxed parent process. Researchers demonstrated launching an application outside Codex’s process tree entirely, and noted the same access path could reach a Docker daemon socket or the global config editor, all while the agent was set to read-only, the strictest sandbox mode.

The attack requires only that a developer open someone else’s repository in Codex and ask a question about the code, giving the repository’s author unsandboxed command execution on the developer’s machine.

Overpatch

The second flaw, Overpatch, lives in the open-source Codex CLI. In workspace-write mode, Codex should only be able to write inside the current project folder. Researchers found that the agent’s own patch tool, apply_patch, grants write access to the parent folder of any path named in a patch, so naming /tmp effectively grants write access to the root of the disk. A crafted patch combining that trick with a symlink into the home directory let attackers append malicious code to a shell startup file, which then ran unsandboxed the next time the developer opened a terminal.

A shared root cause

Both bugs share the same underlying flaw: the enforcement logic lived inside the component it was meant to restrict, letting attacker-controlled input decide its own permissions. Researchers noted the pattern mirrors a July 2026 report from Pillar Security showing similar sandbox escapes across Cursor, Codex, Gemini CLI, and Google’s Antigravity.

What to do

OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0. Users should update to those versions or later immediately.