Overview
Oren Yomtov, principal security researcher at Accomplish AI, found two separate ways to break out of OpenAI Codex's sandbox and run commands directly on the host machine. He reported both to OpenAI on August 12, 2026, and the company shipped fixes for both within eight days. OpenAI closed the Codex Desktop issue in build 26.818.21641 and the Codex CLI issue in version 0.149.0; anyone running older builds should update now.
Heapjack: Stealing a Token From Shared Memory
The first flaw, named Heapjack, targets Codex Desktop's node_repl component. To run an AI coding agent's JavaScript safely, Codex spins up a single Node process containing two separate V8 contexts inside one shared heap: a trusted context holding OpenAI's own code and a secret authorization token, and an untrusted context that runs whatever code the agent is analyzing.
The problem is that "separate context" doesn't mean separate memory. Because both contexts share one heap, Yomtov's proof of concept had the untrusted side take a snapshot of heap memory and scan it for anything shaped like a UUID — which is exactly what the trusted token looks like. Once extracted, that token lets the untrusted code forge authenticated requests back to the parent process and execute commands outside the sandbox entirely. The exploit worked even in Codex's strictest read-only mode, and required nothing more than getting Codex to analyze a malicious repository.
Overpatch: Abusing a Patch Tool's Path Trust
The second flaw, Overpatch, lives in the open source Codex CLI's apply_patch tool, which is supposed to restrict the agent to writing inside its designated workspace folder. The tool derives its write permissions from whatever paths appear inside the patch it's asked to apply — rather than validating those paths against the workspace boundary independently.
Yomtov's technique used a two-part patch: one entry that appended a malicious line to a shell profile file like .zshrc by way of a symlink, and a second, unrelated-looking entry that referenced a path like /tmp to distract from the first. apply_patch honored both, writing outside the workspace despite the CLI supposedly enforcing workspace-write restrictions. The payload then executed automatically the next time the victim opened a new terminal session.
Why It Matters
Both bugs follow the same underlying pattern that has now shown up across multiple AI coding agents in 2026: the sandbox boundary around the agent's own process holds up fine, but the agent's blast radius isn't the process — it's everything the agent can write or influence that a trusted host component reads later. A shared heap, a patch tool that trusts attacker-supplied paths, or an allowlisted command that isn't actually read-only are all doors that don't require breaking the sandbox itself, just walking around it. With coding agents increasingly given standing access to source repositories, credentials, and developer machines, that distinction is becoming one of the more consequential blind spots in how these tools are secured.