Security researchers have identified two distinct sandbox escape vulnerabilities in OpenAI's Codex, a coding agent available as both a command-line interface (CLI) tool and a desktop application. Both flaws, reported to OpenAI on August 12 and subsequently patched within eight days, could allow untrusted code to execute commands on a developer's machine outside the intended sandbox environment.
The more critical of the two vulnerabilities, dubbed "Heapjack" by researchers at Accomplish AI, affects the Codex Desktop application. This flaw leverages a component named `node_repl`, which is automatically installed and configured in the global `~/.codex/config.toml` file. This configuration is also inherited by Codex CLI users. The `node_repl` component runs a single Node.js process containing two JavaScript execution contexts: one trusted, running OpenAI's code, and one untrusted, executing the agent's code.
The Heapjack attack exploits the fact that both contexts share the same memory heap. The trusted context authenticates itself using a randomly generated token, but this token resides in the shared memory space. An attacker's untrusted code can take a snapshot of the heap using `v8.getHeapSnapshot()` and then identify the token. With the valid token, the untrusted code can then inject its own requests into the communication pipe used by the trusted context to interact with a native, unsandboxed parent process. The parent process, validating the token, then executes the attacker's command. A proof-of-concept demonstrated the ability to launch an application outside Codex's process tree, and researchers noted potential targets like Unix sockets or Docker daemon sockets. This exploit functions even in Codex's strictest "read-only" sandbox mode, where the agent is not supposed to perform any write operations.
The second vulnerability, named "Overpatch," is present in the open-source Codex CLI. In "workspace-write" mode, the agent is designed to restrict write operations to within the project folder. However, the `apply_patch` tool, used by Codex for patching, was found to grant write access to the parent directory of any path specified in a patch. By including a patch that names `/tmp` (thereby granting write access to the root of the disk), an attacker could then use a symlink to append a line to the user's `.zshrc` file in their home directory. The next time the developer opens a terminal, the attacker's command would execute unsandboxed.
Both Heapjack and Overpatch share a common underlying design flaw: the enforcement mechanism for the sandbox was co-located with the code it was meant to restrict. In the case of `apply_patch`, permissions were derived from attacker-controlled input, while `node_repl` stored the trust boundary token in the same memory accessible to untrusted code. This class of vulnerability has been observed in other AI agents, including Cursor, Gemini CLI, and Google's Antigravity, where an agent within its sandbox writes a file that a trusted external tool later executes.
OpenAI has confirmed these issues and released patches. Heapjack was addressed in Codex Desktop build 26.818.21641, and Overpatch was fixed in Codex CLI version 0.149.0. Users are advised to update to these versions or later to mitigate the risks.
