Codex Sandbox Escapes Fixed After August Reports to OpenAI

Accomplish AI researcher Oren Yomtov reported two OpenAI Codex sandbox-escape issues to the vendor on 12 August, and OpenAI fixed them within eight days. Users should upgrade to Codex Desktop 26.818.21641 and Codex CLI 0.149.0 or later, which address Heapjack and Overpatch.

Security researchers found two high-impact ways to leave the OpenAI Codex sandbox. Codex is OpenAI's coding agent, also referred to in the original report as the ChatGPT agent, and is used through a command-line tool and a desktop app. Like other coding agents, it is designed to run model-initiated actions inside a sandbox so untrusted code does not reach the rest of the host.

Accomplish AI researcher Oren Yomtov said both issues were reported to OpenAI on 12 August and were fixed within eight days. One of them could run commands on a developer computer in Codex's strictest mode, with no user approval and no on-screen prompt.

Heapjack

Researchers called the more serious issue Heapjack. It could turn a normal review of an external code repository into command execution outside the sandbox. If a user opened someone else's project in Codex and asked a question about the code, the repository author could, in the researchers' account, run unsandboxed commands on that user's machine.

The source said the impact applied in read-only mode, the most restrictive Codex sandbox setting, which is designed so the agent should not write anything. A default-on component shipped with the desktop app and was inherited by CLI users through a shared configuration, with no prompt and no setting to disable it, according to the report. Affected users include developers who open untrusted repositories in Codex Desktop or CLI.

Overpatch

The second issue, called Overpatch, was in the open-source Codex CLI. In workspace-write mode the agent is supposed to write only inside the project directory. Attempts to write to the user's home directory through the shell were designed to be blocked.

Researchers showed that the agent could still change files outside the project tree on the host. The reported impact was persistence on the developer machine, so attacker-controlled code could later run outside the sandbox.

Shared cause

Yomtov said both bugs shared a root problem: the controls that enforced the sandbox sat inside the environment they were supposed to restrict, and could be induced to allow operations they should have blocked.

A similar class of issue was shown in July 2026 by Pillar Security against Cursor, Codex, Gemini CLI, and Google Antigravity. In those cases the agent remained in a sandbox but produced a file that a trusted tool outside the sandbox later ran.

Commenters on Yomtov's public write-up questioned default trust given to untrusted agent code. The original item did not list CVE IDs or CVSS scores.

Fixed versions

Accomplish said OpenAI fixed Heapjack in Codex Desktop 26.818.21641 and Overpatch in Codex CLI 0.149.0. Users should upgrade to those versions or later. Yomtov said OpenAI closed both reports in eight days.

Source: https://www.bleepingcomputer.com/news/security/researchers-escape-openai-codex-sandbox-to-run-commands-on-host/