OpenAI Codex Sandbox Escapes "Heapjack" and "Overpatch" Allow Unsandboxed Command Execution

Scope: OpenAI Codex Desktop (Prior to Build 26.818.21641) and Codex CLI (Prior to Version 0.149.0)

Severity: Red

Security researcher Oren Yomtov of Accomplish AI disclosed two sandbox escape vulnerabilities in OpenAI's Codex coding agent, reported to OpenAI on August 12, 2026, and patched within eight days. Heapjack exploits a shared memory heap between trusted and untrusted JavaScript contexts in Codex Desktop's node_repl component, allowing an attacker to steal an authorization token and achieve unsandboxed command execution simply by having Codex analyze a malicious repository, even in the strictest read-only sandbox mode and without any approval prompt shown to the user. Overpatch abuses the Codex CLI's apply_patch tool, which derives write permissions from attacker-supplied paths, allowing an attacker to escape workspace-write restrictions and write to the user's home directory via a symbolic link, executing code the next time a terminal is opened. Codex is a developer tool typically installed on engineering workstations and build hosts with access to source repositories, cloud credentials, and signing material, making a successful sandbox escape a direct path into an organization's software development environment. Organizations and individual developers using Codex must update Codex Desktop to build 26.818.21641 or later and Codex CLI to version 0.149.0 or later immediately, and should avoid opening repositories from unverified or third-party sources in Codex until the update is confirmed applied.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.