Two sandbox violations in the OpenAI Codex allowed malicious content in a repository to escape the sandbox and execute commands on the developer's computer. The researchers named them Overpatch and Heapjack.
The revelation comes from Oren Yomtov of Accomplish AI. As BleepingComputer, the two issues were reported to OpenAI on August 12, 2026, and were fixed within eight days, according to the researcher.
See also: Claude Opus 5 hacked OpenAI: Researchers entered its internal systems
Violating the sandbox limit in the OpenAI Codex
Heapjack affected Codex Desktop and was a typical example of a sandbox, as it could be activated even in read-only, i.e. the strictest restriction profile. The scenario was triggered when the user opened a repository in Codex that someone else had created and asked the agent to answer a question about the code.
The application installs the node_repl in the common configuration file and runs trusted and untrusted JavaScript in the same Node.js process. The two environments share heap memory, resulting in a random code intended to distinguish trusted from untrusted code that can be retrieved.
The untrusted code would take a memory snapshot using the v8.getHeapSnapshot(), test strings that looked like UUIDs, and recognize the correct code from the different validation response. It could then send a request to the parent process, which is running outside the sandbox, for actions on the computer.
The demonstration used the open to launch an application outside the Codex process chain. The same access could be gained to Unix sockets, such as the Docker socket, and to a tool that modifies the global configuration file. The dangerous element was that the attack did not require a confirmation window or a visible indication on the screen.
Overpatch broke the recording limits
The second finding, called Overpatch, involved the Codex CLI, which is available as an open source tool, in the workspace-write. There, the agent is supposed to be able to write only within the project folder, while a command to the home folder is rejected.
The researchers found that the apply_patch calculated the write permission from the paths contained in the patch itself. A reference to /tmp extended the permission to the root of the disk, while a second change could write via a symbolic link to the .zshrc . The next terminal launch would execute the line outside of the sandbox.
Both incidents demonstrate how critical proper sandboxing , and they share a common cause: the mechanism enforcing the restriction was inside the environment it was supposed to restrict. In Overpatch, the tool was configuring its permissions from input that the agent could control. In Heapjack, the trusted secret remained in the same memory as the untrusted code.
See also: Chrome V8 Zero-Day: Code execution inside the sandbox
Versions to be checked
According to Accomplish and the researchers' technical analysis, Heapjack was patched in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0. Users should install these or later versions and separately check the Desktop application, CLI, IDE integrations, and any automations.
The case is particularly relevant for development teams using AI agents with access to files, terminals, and code review tools. A repository is not just a collection of source code; it can contain settings and links that affect the agent's actions. Thus, evaluating a project should also include checking configuration files before introducing it into an automated workflow.
The SecNews technical team recommends treating third-party repositories with caution, especially when they contain settings, symlinks, or tools that run automatically. For critical tasks, isolating the entire agent in a virtual machine, with real credentials outside the virtual environment, limits the impact of a new exploit.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The sandbox limit check must be repeated when agent versions, tools, or permissions change.
The fixes close these specific paths, but they don't eliminate the general risk of untrusted code passing through AI tools. Version control, isolation, and human approval for actions outside the project remain necessary measures.
See also: OpenAI launches Astra for Legal and its own legal research index
