Discovery of Sandbox Bypasses

Security experts have uncovered two methods to bypass the safety sandbox of OpenAI’s Codex coding agent, including one critical exploit that allows for command execution on a developer's machine without requiring any user approval. These vulnerabilities, which function by defeating security boundaries from within the sandbox, were highlighted in findings reported by Oren Yomtov of Accomplish AI. As detailed in [Yomtov's writeup](https://www.accomplish.ai/blog/escaping-the-openai-codex-sandbox-twice/), the research underscores the ongoing challenges in maintaining secure isolation for AI-powered coding assistants.

Analyzing the Heapjack Exploit

The more severe of the two identified vulnerabilities is dubbed 'Heapjack.' This exploit targets the node_repl component, which Codex Desktop automatically installs in a shared configuration file. By turning routine code queries into remote code execution, Heapjack allows an attacker to gain unsandboxed access to a user's computer simply by having the user open a malicious repository. The flaw exists because the trusted and untrusted JavaScript execution contexts share the same Node.js process and memory heap, allowing an attacker to extract internal authentication tokens.

By capturing these tokens, the untrusted code can communicate directly with the parent process, bypassing all restrictions meant to limit the agent's system interactions. [Pillar Security researchers demonstrated](https://www.bleepagecomputer.com/news/security/cursor-codex-gemini-cli-antigravity-hit-by-sandbox-escapes/) that this class of vulnerability is not unique to Codex; similar issues have affected other AI agents, including those from Google and other prominent developers, as the industry grapples with the complexities of AI-agent security.

The Overpatch Vulnerability

The second identified flaw, known as 'Overpatch,' resides within the open-source Codex CLI. The issue stems from the tool's apply_patch utility, which incorrectly validates permissions when applying code changes. By providing specific inputs, researchers were able to trick the tool into granting write access to directories far beyond the intended project folder, including the disk root.

In a successful proof of concept, the researchers demonstrated that a malformed patch could append unauthorized commands to shell configuration files, such as '.zshrc'. As one observer on social media [wrote that](https://x.com/0zSchnack/status/2100164179399242043) the trust boundary was insufficient, the vulnerability highlighted how enforcement mechanisms that rely on attacker-supplied input are fundamentally prone to failure. Another commentator similarly described the existing security architecture as being nothing more than [a room divider](https://x.com/ctfstudent/status/2100281489774526867) rather than a robust wall.

Remediation and Ongoing Security

OpenAI took immediate action following the report submitted on August 12, 2026. According to Accomplish AI, the company successfully patched the Heapjack exploit in Codex Desktop build 26.818.21641 and addressed the Overpatch vulnerability in Codex CLI 0.149.0. OpenAI has maintained its commitment to addressing these security concerns, though industry analysts continue to monitor the broader landscape of AI-agent risks.

Users are advised to ensure their software is updated to these versions or higher to protect their systems. As the industry continues to advance, companies remain under pressure to provide transparent security practices, especially following instances where [OpenAI admits it didn't disclose rogue AI wiki hijacking incident](https://www.bleepingcomputer.com/news/security/openai-admits-it-didnt-disclose-rogue-ai-wiki-hijacking-incident/) in previous reports.

Sources

• BleepingComputerResearchers escape OpenAI Codex sandbox to run commands on host