Two recently disclosed sandbox escapes in OpenAI Codex have put fresh attention on a question that now follows every local AI coding agent: where does a safe workspace end, and where does the developer’s machine begin?
Security researcher Oren Yomtov of Accomplish AI disclosed the flaws on September 15, 2026. Accomplish said both were reported to OpenAI on August 12 and fixed within eight days. The two escape paths, named Overpatch and Heapjack by the researchers, affected different parts of the Codex stack and reached outside the intended sandbox in different ways.
What the researchers found
OpenAI has described the Codex sandbox as the technical boundary controlling where Codex can write, whether it can reach the network, and which paths remain protected. Approval policies decide when Codex must ask before an action crosses that boundary.
Against that model, Accomplish reported two separate boundary breaks:
Overpatch affected Codex CLI and the apply_patch file-editing path. The researchers said path handling in patches could widen write access outside the workspace in workspace-write mode.
Heapjack affected Codex Desktop’s JavaScript helper. Accomplish said trusted and untrusted JavaScript contexts shared a V8 heap, allowing untrusted code to find a token used by the trusted side and reach unsandboxed command execution, even in read-only mode.
In both cases, the risk came from the boundary around the agent, not from the ordinary output of a coding model. That distinction matters because many teams treat sandbox mode as the main control that makes agentic coding safe on a local machine.
Why Heapjack drew more concern
Heapjack drew more concern because it reportedly worked from read-only mode, the setting users are most likely to treat as safe for looking at unfamiliar code. Accomplish described a scenario in which a user opened another person’s repository in Codex Desktop and asked a question about it; the malicious repository content then had a route to unsandboxed host commands without a visible approval prompt.
The technical issue, as described by the researchers, was not that read-only mode allowed ordinary file writes. The failure sat underneath that policy. A token separating trusted from untrusted JavaScript lived in shared process memory; once untrusted code could read the token, it could speak to the privileged parent as if it were trusted.
How Overpatch crossed the workspace boundary
Overpatch was in the open-source CLI and is easier to verify through public GitHub records. Accomplish said Codex’s apply_patch tool granted write access based on parent directories named in a patch. A crafted patch could cause the tool to grant broader write permissions than the active workspace policy intended.
OpenAI’s GitHub pull request #39614, merged on August 20, is titled Prevent apply_patch from widening write permissions. The pull request says deriving permissions from the parent of an already writable patch target could grant write access outside the intended workspace, and that the fix skips targets already covered by the active filesystem sandbox policy before deriving extra parent permissions.
Fixed versions and OpenAI’s response
Accomplish and BleepingComputer both reported that OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0. OpenAI’s public GitHub release for Codex CLI 0.149.0 was published on August 20, 2026, the same day pull request #39614 was merged.
Codex CLI: 0.149.0 or later for the Overpatch fix.
Codex Desktop: build 26.818.21641 or later for the Heapjack fix, according to Accomplish and BleepingComputer.
BleepingComputer later added a statement from OpenAI saying the company addressed both issues in August and was continuing to strengthen sandbox controls around where agents can write files and how those protections are tested across platforms.
Why this matters beyond Codex
The larger security lesson is not limited to one coding agent. Local AI coding tools are often installed on developer workstations that already have access to source code, package registries, deployment keys, cloud CLIs, SSH agents, and internal systems. A sandbox escape from an agent process can become a shortcut into the same environment a developer uses to build and ship software.
The Codex cases also show why read-only modes and approval prompts should not be treated as complete isolation. They are controls around a complex chain: repository input, model instructions, patch tools, shell runners, desktop helpers, Model Context Protocol servers, filesystem policies, and host operating-system permissions. If one trusted helper is too close to untrusted input, the agent may stay within its apparent instructions while the system boundary still fails.
What teams using Codex should do
For organizations and individual developers using Codex, the first response is version verification, not assumption. CLI and Desktop installs should be inventoried separately because the fixed versions are different, and desktop apps can bundle their own CLI or helper components.
Update Codex CLI to 0.149.0 or later, and prefer the current approved release rather than stopping at the minimum fixed version.
Update Codex Desktop to build 26.818.21641 or later.
Investigate Codex sessions involving unfamiliar repositories before those updates, especially where shell startup files, workspace symlinks, local credentials, package scripts, or MCP tools were in scope.
Treat unknown repositories as executable input when opened by an agent, even if the agent is only being asked to inspect the code.
Run agentic coding tools in isolated dev containers, virtual machines, or dedicated low-privilege accounts when reviewing third-party code.
What is still unclear
As of September 25, 2026, OpenAI’s public Codex GitHub security advisories page showed a separate 2025 sandbox advisory, but no public advisory named Heapjack or Overpatch. The public record for Overpatch is stronger because the relevant CLI fix appears in the open-source repository. Heapjack’s exact patch details are less visible because the affected Desktop component is not documented the same way in a public GitHub security advisory.
That does not make the disclosed Desktop issue unimportant. It means administrators should rely on the fixed build information reported by Accomplish and repeated by BleepingComputer, then verify installed versions directly rather than waiting for a CVE or a separate advisory page to appear.
For Tech Help Canada readers, the safest reading is straightforward: AI coding agents should be patched with the same urgency as developer tools, package managers, IDEs, browsers, and terminal helpers. The agent may be new, but once it can read code, edit files, run commands, and call local tools, it belongs inside the normal software security program.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
