Critical OpenAI Codex Sandbox Flaws Let Attackers Execute Commands

Key Takeaways

• Two critical vulnerabilities, “Overpatch” and “Heapjack,” were discovered in OpenAI Codex.
• These flaws could allow attackers to execute arbitrary commands on a developer’s local system, even in sandboxed environments.
• “Overpatch” affected the Codex CLI’s patch application process, while “Heapjack” impacted the Codex Desktop’s node_repl tool.
• OpenAI swiftly patched both vulnerabilities; users are urged to update to Codex CLI 0.149.0+ and Desktop 26.818.21641+.

OpenAI Codex, the AI-powered programming assistant, recently grappled with two severe security vulnerabilities that could have permitted malicious code repositories to compromise a developer’s local machine and execute arbitrary commands. These issues, dubbed “Overpatch” and “Heapjack,” highlight the ongoing challenges of securing AI agent environments.

Both vulnerabilities were reported to OpenAI on August 12, 2026, and the company deployed fixes within a week, demonstrating a rapid response to critical security disclosures.

Heapjack: Sandbox Escape via Shared Memory

The more severe of the two, Heapjack, presented a critical risk where an attacker could achieve command execution without any user prompts or warnings, even when Codex was operating in its supposedly secure read-only sandbox mode. This flaw was exploitable when a developer interacted with an attacker-controlled repository within Codex and queried the agent about its contents.

Heapjack specifically impacted the node_repl tool, a component installed by Codex Desktop. Upon installation, Codex Desktop configured this tool in the global ~/.codex/config.toml file, making it available for standard Codex CLI sessions.

The core of the Heapjack vulnerability lay in the architecture of the node_repl tool, which consisted of a Rust parent process and a sandboxed Node.js process. While both trusted OpenAI code and untrusted agent-controlled code operated within distinct V8 virtual-machine contexts, they shared the same V8 isolate and memory heap. This shared memory became the Achilles’ heel.

An untrusted JavaScript entity could take a snapshot of the shared heap and then scan it for UUID-like strings, effectively locating the authorization token intended for trusted requests. Once this token was recovered, the untrusted code could forge requests through the shared standard-output channel to the unsandboxed parent process. These forged requests could then invoke system commands, such as the open command, enabling applications to launch outside of Codex’s intended process boundaries.

Furthermore, this compromised authorization mechanism could facilitate interactions with Unix sockets, including the Docker daemon socket, or even allow modifications to the global Codex configuration file, expanding the scope of potential damage.

Overpatch: Elevated Permissions in Codex CLI

The second vulnerability, Overpatch, was identified within the open-source Codex CLI and its apply_patch editing tool. Ideally, Codex should strictly confine file modifications to the active project directory to maintain security boundaries.

However, researchers discovered that the apply_patch tool granted permissions based on the parent directories specified within a submitted patch. By maliciously incorporating a directory named /tmp into a patch, the tool could erroneously extend write access starting from the root directory, circumventing the intended workspace limitations.

A proof-of-concept exploit demonstrated this vulnerability by using a symbolic link to append a malicious command to the user’s .zshrc file, located in the home directory. Although this specific patch attempt, which aimed to overwrite a directory, failed, it still inadvertently expanded the tool’s file-write permissions beyond the intended scope.

Consequently, when the user subsequently opened a terminal, the modified shell configuration could execute attacker-controlled code, effectively escaping the Codex sandbox and operating with the user’s privileges.

This incident underscores a crucial security principle: boundaries should never be determined by paths provided by untrusted content. Since an attacker can manipulate patch content, there’s an inherent risk that an editing request could grant access to areas outside the project folder, leading to potential exploitation.

OpenAI responded promptly to these vulnerabilities, releasing fixes for Overpatch in Codex CLI version 0.149.0 and for Heapjack in Codex Desktop build 26.818.21641.

What You Should Do

• Update Immediately: All users of OpenAI Codex are strongly advised to update their installations. Ensure your Codex CLI is at version 0.149.0 or higher, and your Codex Desktop application is at build 26.818.21641 or higher.
• Exercise Caution with Untrusted Repositories: Be particularly vigilant when interacting with cloned, third-party, or untrusted code repositories. Do not rely solely on “read-only” mode as absolute protection against agent-driven code execution.
• Isolate Sensitive Information: For developers integrating AI agents, ensure that enforcement logic and sensitive information are strictly isolated from environments where untrusted code can operate.
• Regard Sandboxes as Risk Mitigation: Understand that sandboxes alleviate risk but do not provide absolute assurance against all threats. Always treat content from unfamiliar repositories with extreme caution.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.