# Codex Sandbox Escapes: Heapjack and Overpatch — Update Now > Source: > Published: 2026-09-22 16:08:20+00:00 Researcher Oren Yomtov of [Accomplish AI](https://www.accomplish.ai/blog/escaping-the-openai-codex-sandbox-twice/) found two ways to break out of OpenAI Codex’s sandbox, and one of them works even when Codex is running in strict read-only mode. Both vulnerabilities were reported on August 12, patched within eight days, and publicly disclosed on September 15. If you are running Codex Desktop before build 26.818.21641 or Codex CLI before 0.149.0, you are still exposed. ## Heapjack: The One That Defeats Read-Only Mode Heapjack targets `node_repl`, a helper tool that Codex Desktop registers in `~/.codex/config.toml`. The tool uses a native Rust process outside the sandbox and a Node.js child process inside it, with two separate V8 vm contexts — one for trusted code, one for agent-controlled untrusted code. The problem is that both contexts share the same V8 isolate and, by extension, the same heap. The trusted context receives a random authorization token that it uses to send commands to the Rust parent. The untrusted context can call `v8.getHeapSnapshot()`, scan the heap for UUID-shaped strings, and identify that token by probing response differences. With the token in hand, untrusted code sends a request over the same pipe as trusted code. The Rust parent has no way to tell the difference and accepts it as authorized. That is arbitrary command execution on your host machine, without any approval prompt, regardless of sandbox mode. The attacker’s only prerequisite is that you open a malicious repository in Codex and ask the agent a question about the code. ## Overpatch: Persistent Code Outside the Sandbox Overpatch lives in Codex CLI’s `apply_patch` tool. The tool grants write access to the parent directory of each path listed in a submitted patch — reasonable in isolation, broken in practice. Referencing `/tmp` as a path in a patch means the tool computes the parent as `/` and expands write access to the entire filesystem root. From there, a second patch can follow a symlink into the user’s home directory and append arbitrary content to `~/.zshrc`. The payload runs outside the sandbox the next time the user opens a terminal — no Codex involved at all. This is persistence. The attacker’s code survives the Codex session and re-executes independently. [BleepingComputer has a full writeup](https://www.bleepingcomputer.com/news/security/researchers-escape-openai-codex-sandbox-to-run-commands-on-host/) with the complete proof-of-concept flow. ## What You Need to Do The fixes are available and the steps are straightforward: - **Codex Desktop:** Update to build 26.818.21641 or later. Check your current build in the app’s About screen. - **Codex CLI:** Run`npm install -g @openai/codex@latest` and verify you are on 0.149.0 or later. - **If you ran older versions against untrusted repositories:** Check`~/.zshrc` ,`~/.bashrc` , and other shell startup files for unexpected entries. A targeted endpoint review is warranted if you regularly cloned third-party code. - **Going forward:** Run Codex inside a Docker container or VM when working with repositories of uncertain origin. Strict mode is not a substitute for host-level isolation — this disclosure proves it. ## The Broader Pattern Is Hard to Ignore This is the third AI coding tool security incident disclosed in 60 days. [GitSpawn was a Git config RCE](https://byteiota.com/gitspawn-ai-coding-agents-hit-by-git-config-rce-flaw/) that hit AI coding agents. The [libheif vulnerability led to an OpenAI breach](https://byteiota.com/openai-breached-via-libheif-bug-what-developers-must-fix/) via HEIC uploads processed through ImageMagick. Now this. Cursor also patched a workspace hook RCE (CVE-2026-48124) in version 3.0.0, and a Docker-socket misconfiguration bug hit Cursor, Codex, and Gemini CLI simultaneously. The common thread across these incidents is what you could call the trusted helper gap. AI coding agents rely on auxiliary tools — patch utilities, REPL helpers, shell hooks — that sit adjacent to the sandbox boundary. These helpers often carry implicit trust that the agent’s policy layer does not audit. Attackers are finding those gaps faster than vendors are closing them. Read-only mode sounds restrictive, but Heapjack demonstrates that “read-only” only describes what the agent’s policy layer permits — not what the underlying execution environment can do if the right channel is available. The sandbox model for AI coding agents is still being defined in production, and the definitions keep changing after incidents like this one. Update your tools. Check your shell files. And treat any repository you did not write yourself as untrusted input — because that is exactly what it is.