Overpatch and Heapjack: Two Techniques for Bypassing Codex's Write Restrictions and Escaping Its Read-Only Sandbox

#

1. Basic Information

• Original Title: Escaping the OpenAI Codex sandbox, twice

- Source: Accomplish AI
- Published: 2026-09-15
- Updated: None
- Severity: High

• Basis for Severity: Researchers verified Overpatch, which writes outside the workspace using workspace-write , and Heapjack, which executes host commands from the strictestread-only mode without an approval prompt. Conditions were also shown where simply opening a malicious repository and asking a question is enough. Both issues were patched within eight days of reporting, and no exploitation in real-world attacks has been reported.
• Original Article: Escaping the OpenAI Codex sandbox, twice
• Related Sources: BleepingComputer: Researchers escape OpenAI Codex sandbox to run commands on host ,OpenAI Codex CLI 0.149.0 release
• Related Entities: OpenAI Codex CLI, Codex Desktop, apply_patch, node_repl, V8 vm context, macOS, Unix socket, Docker daemon

#

2. Quick Summary

Overpatch abuses the way apply_patch derives write permissions from paths in a patch, allowing writes outside the workspace while Codex is in workspace-write mode. Heapjack recovers the trusted context's authorization token from the shared V8 heap and submits forged requests that the unsandboxed native parent accepts, even when Codex is in read-only mode.

#

3. Attack Flow

The two techniques use separate attack paths. Both are sandbox escapes verified in a research environment, and public materials report no exploitation in real-world attacks.

Attack Path A: Overpatch (workspace-write)

1. In the Codex CLI workspace-write mode, regular shell commands writing to$HOME are blocked.
2. The apply_patch function at the time granted write permissions based on the parent directory of each path specified in the patch.
3. Researchers added a no-op patch entry naming /tmp as a file target. The write failed because/tmp is a directory, but its parent,/ , was nevertheless added to the allowed write scope.
4. Using the same patch, they appended a line to $HOME/.zshrc via a symbolic link inside the workspace.
5. When the developer next opens a terminal, the command added to .zshrc runs outside the sandbox.

Attack Path B: Heapjack (read-only)

1. Codex Desktop at the time added [mcp_servers.node_repl] to the global~/.codex/config.toml , making it available from the Codex CLI as well.

node_repl starts a Node.js process inside the sandbox, which contains two V8vm contexts (trusted and untrusted) sharing the same V8 isolate and heap. 3. The trusted context attaches a freshly generated random token to requests sent to the native Rust parent process. Untrusted code takes a heap snapshot using v8.getHeapSnapshot() and tests UUID-shaped strings as candidate tokens. 4. Incorrect tokens return authorization errors, while a combination of a correct token and invalid arguments returns validation errors, allowing the response difference to serve as an oracle to identify the token. 5. The untrusted code writes JSON Lines requests to the same standard output pipe as the trusted context. The native parent process validates the token and processes it as a regular request. 6. In the PoC, the macOS open command was launched outside the sandbox. The researchers explained that the recovered token could also be used to connect to Unix sockets, including a Docker daemon socket, and to invoke the tool that edits the global Codex configuration.

#

4. Attacker Position and Execution Location

• Attackers can start from an untrusted repository opened by a developer in Codex or instructions passed from its content to the agent.
• Overpatch is carried out through the Codex CLI patch tool and a symbolic link within the workspace, with the final command executed on the host during the next shell startup.
• Heapjack's untrusted JavaScript runs inside the sandbox, but retrieves the token from the same heap and sends requests to the native node_repl parent process outside the sandbox.
• The PoCs were demonstrated in a research environment; no specific attackers or actual damage have been reported.

#

5. Victim and Administrator Perspective

Victims : In Heapjack, even asking a question about a repository inread-only mode can launch host-side applications without an approval prompt or screen display. In Overpatch, there is no clear warning during patch processing, and the injected command executes when the terminal is next launched. #

Administrators : Evidence includesnode_repl settings in~/.codex/config.toml , symbolic links pointing from inside the workspace to the home directory, unexpected changes to.zshrc , andopen executions or Unix socket connections from Codex-related processes.

#

6. Success and Failure Conditions

Success Conditions

Overpatch : Using an unpatched version of the Codex CLI inworkspace-write mode, and allowing the agent to combine a patch containing paths like/tmp with symbolic links inside the workspace. #

Heapjack : Utilizingnode_repl added to global settings by an unpatched version of Codex Desktop, allowing untrusted JavaScript to access the heap snapshot and the shared pipe to the parent process.

• A developer loads an untrusted repository into Codex, and its contents affect agent tool execution.

Failure Conditions

• Updating to Codex CLI 0.149.0 or later and Codex Desktop build26.818.21641 or later, as indicated by Accomplish as patched versions.
• Containing the agent, tools, and child processes within a VM boundary separate from the host, ensuring host credentials and Docker sockets are not passed to the guest. This is an additional defense adopted by Accomplish and does not replace applying the patched versions.
• Controlling access to paths outside the workspace, symbolic links, global settings, and Unix sockets using both policies and telemetry.

#

7. What Happens Upon Success

• Overpatch allows writing to files outside the workspace and executing commands on the host during the next terminal startup by modifying shell settings.
• Heapjack allows calling native parent process functions outside the sandbox even in read-only mode, including launching host-side applications, connect to Unix sockets, and modify global Codex configurations.
• In configurations where the native helper can reach a Docker daemon socket, container-level impact may be possible. The researchers identified the socket as reachable with the recovered token but did not report a successful Docker host compromise.
• Subsequent access to credentials, source code, signing keys, and cloud sessions available on the host depends on the environment; public materials report no actual damage.

#

8. Observable Logs

Email : No email-based attack vectors have been reported. #

Proxy / SWG / DNS : Check for cloning/fetching of untrusted repositories and new outbound traffic from processes launched outside the sandbox. Since the sandbox escape itself occurs between local processes, it cannot be detected via network logs alone. #

Endpoint / EDR : Check for behavior associated with heap snapshot acquisition from Codex/Node.js,open execution from the nativenode_repl parent process, changes to.zshrc and~/.codex/config.toml , and writes outside the workspace via symbolic links. #

Identity / IdP : Check authentication and token usage for developer tokens, GitHub credentials, cloud sessions, and signing credentials that were available after the sandbox escape. The article does not report actual credential abuse. #

SaaS / Cloud : Check connected GitHub or cloud services for unknown API calls, repository changes, token issuance, and access to secrets following Codex execution timestamps. #

Network : Where host-level socket telemetry is available, check for connections from Codex-related processes to Unix sockets, Docker daemon sockets, and local services. Separately review outbound traffic from applications or processes launched after the relevant Codex activity.

#

9. Attack Success Determination

Confirmed in Public Information

Initial Execution Confirmed (Research Environment) : For Overpatch, appending to.zshrc and executing commands upon the next terminal startup was verified; for Heapjack, executing the macOSopen command fromread-only mode via the native parent process was verified. #

Actual Damage Unconfirmed : Public materials report no instances of these methods being used in real-world attacks, credential theft, repository tampering, or Docker host compromise.

Internal Determination Criteria

Initial Execution Confirmed : Cross-reference Codex session/tool logs, patch contents, file metadata, and process telemetry to substantiate writes outside the workspace or host command execution via the native parent process. #

Information Theft or Session Compromise Confirmed : Confirm evidence that the post-sandbox-escape process accessed credential files, keychains, agent sockets, or cloud tokens, and that those credentials were used in another session or from an external system. #

Subsequent Compromise Confirmed : Substantiate unauthorized modifications in GitHub/cloud, Docker daemon operations, additional payload execution, or persistence.

#

10. Investigation Playbook

Trigger : Start withopen execution from Codex, changes to.zshrc / global Codex settings, writes outside the workspace, or unknown Docker API operations. #

Initial Verification : Check Codex CLI/Desktop versions, execution modes, target repositories, session logs, tool calls, patch contents, andnode_repl settings. #

Endpoint : Preserve.zshrc ,~/.codex/config.toml , symbolic links within the workspace, process trees, file metadata, shell startup history, and heap-snapshot-related artifacts. #

Authentication and Cloud : Enumerate GitHub, cloud, package registry, signing, and SSH credentials accessible from the host, and check usage history after Codex sessions. #

Subsequent Operations : Track access to Unix sockets/Docker daemons, host-side applications, child processes, outbound traffic, and repository/cloud changes. #

Containment : Terminate the affected Codex session and isolate the affected host from the network. Update to patched versions, revert unauthorized changes outside the workspace, and revoke/reissue potentially exposed credentials. #

Classification : Separate untrusted repository , tool abuse, sandbox escape, host command execution, credential access, unauthorized use, and subsequent modifications.

#

11. Defense and Detection Ideas

Single Events : Detect operations where the Codex patch tool references paths outside the workspace, writes to the home directory from workspace-internal symbolic links, andopen or Docker socket accesses from Codex-related processes. #

Timeline Correlation : Correlate cloning of untrusted repositories, Codex session initiation, patch/node_repl usage, global/shell setting modifications, host-side process launches, and credential usage. #

Threat Hunting : Search for change histories of.zshrc and~/.codex/config.toml , symbolic links pointing from the workspace to the home directory, application launches outside Codex parent-child processes, and unexpected Docker operations. #

Log Gaps : Agent logs alone may overlook execution in native parent processes or subsequent shells. Record tool calls, file integrity, processes, local sockets, and credential usage on the host side. #

Priority Countermeasures : Prioritize updating Codex CLI/Desktop, isolating untrusted repositories, separating host credentials and Docker sockets, monitoring writes outside the workspace, and enforcing least privilege for connected services.

#

12. Facts / Inference / Hypothesis

Facts

• Accomplish reported two issues to OpenAI on August 12, 2026, stating they were fixed within eight days.
• The Overpatch PoC expanded the allowed range to / by specifying/tmp in the patch and appended to$HOME/.zshrc via a symbolic link.
• The Heapjack PoC identified trusted tokens from the same V8 heap, wrote requests to the shared pipe to the native parent process, and executed the macOS open command fromread-only mode.
• Accomplish lists Codex CLI 0.149.0 and later, and Codex Desktop build26.818.21641 and later as patched versions. The changelog for OpenAI's Codex CLI0.149.0 release listsPrevent apply_patch from widening write permissions (#39614),Harden unsandboxed patch filesystem access (#39659), andPrevent Node REPL auth tokens from reaching child processes (#39301). It does not name the findings as Overpatch or Heapjack and does not document the Codex Desktop fix.
• Exploitation in real-world attacks and actual damage have not been reported.

Inference

• A trust boundary cannot safely rely only on checks performed inside the component it is intended to constrain, particularly when tools derive permissions from untrusted input or authorization secrets share memory with untrusted code.
• Running the agent in a VM separate from the host and withholding host credentials and privileged sockets can reduce the blast radius if the application sandbox is breached. Patched versions and least-privilege access to connected services are still required.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in the "Unknowns and Further Investigation" section.

#

13. MITRE ATT&CK Mapping

T1203 Exploitation for Client Execution (Confidence: high): Starting from a developer handling an untrusted repository in Codex, client-side sandbox implementations are abused to proceed to code execution on the host. #

T1546.004 Event Triggered Execution: Unix Shell Configuration Modification (Confidence: high): Overpatch appends commands to.zshrc and uses the next shell startup as the execution trigger.

#

14. Unknowns and Further Investigation

• The exact minimum versions affected by both issues and differences across operating systems.
• The full scope of node_repl operations available in Heapjack and native parent process functions per OS.
• The presence or absence of real-world exploitation, malicious repositories, credential theft, and repository/cloud modifications.
• Official advisories published by OpenAI explicitly mapping Overpatch/Heapjack, and official release information and fix details for Codex Desktop build 26.818.21641 cited by Accomplish.

#

15. Impact on SOCs and Organizations

Running an AI coding agent in read-only mode is useful, but this case shows that the mode label alone does not define the host's exposure. The trust boundary must include tools, native helpers, shared memory, local sockets, and connected services. Because developer workstations often hold GitHub, cloud, package-registry, and code-signing credentials, organizations should combine agent version management with isolated environments for untrusted repositories, exclusion of host credentials, least-privilege access to connected services, and host-level telemetry.

#

16. Summary by Target Audience

For SOCs : Review timelines encompassing not only Codex sessions, but also file modifications outside the workspace, host-side processes from native parent processes, Unix sockets, and credential usage. #

For Administrators : Update to Codex CLI0.149.0 or later and Desktop build26.818.21641 or later, and separate host credentials and privileged sockets from environments handling untrusted repositories. #

For Users : Update Codex to the latest version, avoid opening unknown repositories directly on primary development endpoints, and report unexpected tool execution or setting changes to administrators.

source & further reading

dev.to — original article OwlLayer AI: Letting AI Agents Act on Your UI Instead of Replacing It Base, Chat and Reasoning Models: How Are They Different? Every AI Feature Has an Energy Cost