# OpenAI Patches Two Codex Sandbox Escapes That Enabled Unapproved Code Execution > Source: > Published: 2026-09-21 00:13:03+00:00 Security researchers found two separate ways to break out of the sandbox that is supposed to contain OpenAI’s Codex coding agent, with one flaw capable of running commands on a developer’s machine without any approval prompt or on-screen warning. Both issues were reported to OpenAI on August 12 and fixed within eight days, according to Oren Yomtov of Accomplish AI, who published the technical details of the discovery. The more severe of the two, dubbed Heapjack, could be triggered simply by opening someone else’s repository in Codex and asking the agent a question about the code inside it. Doing so handed the repository’s author unsandboxed command execution on the victim’s computer, even while Codex was running in its strictest, read-only mode, where the agent is not supposed to write anything at all. The discovery adds to a growing body of research this year showing that sandbox escapes are not unique to any single AI coding tool. OpenAI has released patched versions of both Codex Desktop and Codex CLI, and users running older builds are advised to update. ### The Heapjack Flaw: From Reading Code to Running Commands Heapjack targets node_repl, a component Codex Desktop installs automatically into the shared `~/.codex/config.toml` file, with no opt-in and no way to disable it. Because the file is shared, Codex CLI users pick up the same component even though they never explicitly installed it. #### How the Trusted Token Leaked node_repl runs a single Node.js process containing two JavaScript execution contexts: a trusted one holding OpenAI’s own code, and an untrusted one running the agent’s output. The trusted side proves its identity to a native parent process using a random token generated at each run. The flaw is that both contexts share the same memory heap, so the token is not actually secret from the untrusted side. Yomtov’s writeup describes how the untrusted code pulls a snapshot of that heap with `v8.getHeapSnapshot()` and tests every string shaped like a UUID against the parent process. A wrong guess returns an authorization error; a correct token returns a different kind of error, revealing which string was right. #### Reaching the Docker Socket Once the untrusted code holds a valid token, it can write requests on the same channel the trusted context uses to reach the unsandboxed parent process. The proof of concept used this to launch an application outside Codex’s process tree, but the same access could reach any Unix socket on the system, including a Docker daemon socket, or a tool that edits the global configuration file. ### Overpatch: Turning a Patch Tool Into a Root Path The second flaw lives in the open-source Codex CLI’s own patch tool, apply_patch. In workspace-write mode, Codex is meant to write only inside the current project folder, and a shell command aimed at the home directory is normally refused. [Google Chrome Now Runs Quantum-Safe Encryption by Default, but HTTPS Still Has a Blind Spot](https://www.kobaran.com/google-chrome-now-runs-quantum-safe-encryption-by-default-but-https-still-has-a-blind-spot/) #### The Symlink Trick The researchers found that apply_patch grants write access to the parent folder of any path named in a patch, and naming `/tmp` grants access to the root of the disk. Their working exploit combined that with a symlink into the home directory, appending a line to `.zshrc` that ran unsandboxed the next time the developer opened a terminal. ### A Shared Design Flaw Across AI Coding Agents | Flaw | Sandbox mode affected | Trigger | Fixed in | |---|---|---|---| | Heapjack | Read-only (strictest) | Opening and querying an untrusted repository | Codex Desktop 26.818.21641 | | Overpatch | Workspace-write | Crafted apply_patch request with a symlink | Codex CLI 0.149.0 | Both bugs share the same underlying mistake: the mechanism enforcing the sandbox boundary lived inside the process it was meant to restrict, letting attacker-supplied input talk it into granting access. ##### Prior Research From Pillar Security This is not an isolated pattern. In July 2026, researchers at Pillar Security demonstrated a similar class of escape across Cursor, Codex, Gemini CLI and Google’s Antigravity, where an agent stays technically inside its sandbox but writes a file that a trusted tool outside the sandbox later executes. ### Fixes and Response OpenAI resolved both issues within eight days of Yomtov’s report, according to Accomplish AI. Codex Desktop users should update to build 26.818.21641 or later, and Codex CLI users to version 0.149.0 or later. BleepingComputer said it reached out to OpenAI for comment prior to publishing its report on the findings.