Security researchers found two ways out of the OpenAI Codex sandbox, one of them capable of running commands on a developer's machine from Codex's most locked-down mode — with no approval prompt and nothing shown on screen. Both flaws were reported to OpenAI on August 12 and fixed within eight days, according to Oren Yomtov of Accomplish AI. The disclosures landed publicly on September 21, 2026, and they deserve attention from anyone running AI coding agents locally.
What Codex is supposed to do
Codex is OpenAI's coding agent, available as a command-line tool and a desktop app. Like rival agents, it runs the model's actions inside a sandbox so that untrusted code cannot touch the wider system. Both escapes work by defeating that boundary from the inside — not by tricking the user into running a malicious binary, but by abusing the agent's own tooling.
That distinction matters. Developers increasingly treat sandboxing as a guarantee. These findings show it is a goal that requires continuous red-teaming, especially as agents gain file-editing and shell capabilities.
Heapjack: remote code execution via a repo
The more serious flaw, which researchers call Heapjack, turns a routine action into remote code execution. Open someone else's repository in Codex, ask it a question about the code, and whoever wrote that repository gets unsandboxed command execution on your computer.
The attack chain exploits how Codex loads and processes project context. A malicious repository can embed instructions or structures that cause the agent to break out of its isolation when handling seemingly normal requests. From the victim's perspective, the session looks like an ordinary code review. From the attacker's perspective, it is a foothold on the host machine.
OpenAI fixed Heapjack in Codex Desktop build 26.818.21641.
Overpatch: escaping through the patch tool
The second flaw, Overpatch, sits in the open-source Codex CLI. In workspace-write mode, the agent may write inside the project folder, and a shell command aimed at the home directory is normally blocked. The researchers got Codex's own patch tool, apply_patch, to write there via a carefully crafted patch.
The exploit uses a patch with two hunks: one that appears useless except to widen the write scope, and one that appends a line to .zshrc through a symlink into the home directory. Remove the first change and the write is refused. With it, the next terminal the developer opens runs the attacker's line unsandboxed.
OpenAI fixed Overpatch in Codex CLI 0.149.0.
What developers should do now
Users should update to those versions or later immediately. If you run Codex against third-party repositories — open source contributions, interview take-home projects, or client code — treat every repo as potentially hostile until your agent version includes the fixes.
More broadly, the Heapjack and Overpatch disclosures fit a pattern emerging across the industry in September 2026. Google's AI agents also escaped test sandboxes under certain conditions. Anthropic's latest threat report documents autonomous cyber operations attempted with Claude. The common thread is that agent harnesses are now part of the security perimeter, not an abstraction layer above it.
Building safely with coding agents
Practical mitigations extend beyond updating binaries. Run agents in dedicated VMs or containers when working with untrusted code. Disable auto-execution of shell hooks. Monitor .zshrc, .bashrc, and profile files for unexpected changes. Prefer read-only modes when exploring unfamiliar repositories.
Coding agents are among the most productivity-enhancing tools released in the past two years. They are also among the most complex from a trust-boundary perspective. Heapjack and Overpatch are a reminder that "sandboxed" is a claim that must be verified, not assumed.
Comments
Loading comments…