Codex sandbox escapes disclosed by researchers used two patched paths: an over-permissive patch helper and a native parent reached through shared JavaScript runtime state.
Key takeaways
- Accomplish says it reported both issues on August 12 and OpenAI fixed them within eight days.
- Overpatch crossed workspace write boundaries; Heapjack recovered a reference to a native helper and invoked it outside the sandbox.
- The disclosed fixed floors are Codex CLI 0.149.0 and Desktop 26.818.21641, with no public evidence of in-the-wild exploitation.
What the Codex sandbox escapes exposed
The Codex sandbox escapes disclosed on September 15 were two different failures with one shared lesson: isolation is only as strong as the trusted components that sit outside it. Accomplish researchers named the flaws Overpatch and Heapjack. They said both were reported to OpenAI on August 12 and fixed within eight days, before public disclosure.
Overpatch targeted the patching workflow. The sandboxed agent could ask a helper process to apply changes, but the helper's path validation reportedly allowed writes beyond the intended workspace boundary. Heapjack was deeper: the researchers said code in a restricted JavaScript context could inspect a shared V8 heap, recover a reference to a privileged native object, and use that object to invoke an unsandboxed parent process.
Two paths across different boundaries
Overpatch was primarily a filesystem-boundary failure. A patch mechanism needs to write files on behalf of an agent, which makes it privileged by design. If the helper accepts paths that resolve outside the approved project, the sandbox may remain intact while the helper performs the forbidden action. The correct boundary therefore has to be enforced again in the trusted process using canonical paths and an allowlist.
Heapjack concerned process and runtime isolation. Accomplish described a shared heap between a restricted Node.js context and a native parent. JavaScript's vm facility can separate names and objects for application logic, but Node's own documentation has long cautioned that it is not a security mechanism. A reachable native binding can collapse the distinction between the restricted context and the host process.
The researchers said Heapjack worked even in a read-only configuration because the relevant capability did not depend on normal workspace writes. That makes the issue a useful counterexample to the idea that read-only mode alone contains an agent. A read-only agent that can reach an unsandboxed command primitive still has a high-impact path.
Fixed versions and what users should do
The disclosure lists Codex CLI 0.149.0 or later and Codex Desktop 26.818.21641 or later as fixed. Independent write-ups from BleepingComputer, General Analysis and AiCybr repeated those version floors after reviewing the research and public patches. Users should verify the installed version rather than assume an auto-update completed.
No reviewed source reported exploitation in the wild. That is an important limit: a working proof of concept demonstrates impact, not prior attacker use. Teams should still review historical agent sessions on systems that ran older builds, especially where an agent processed untrusted repository content or had access to valuable credentials.
Why prompt trust is part of the threat model
Coding agents routinely ingest repository files, issue text, build logs and tool output. Any of those inputs can contain instructions intended to redirect an agent. A sandbox is supposed to reduce the consequence when an agent follows hostile or mistaken instructions. If a trusted helper exposes broader rights, prompt-origin controls and sandbox controls can fail together.
This does not mean every repository is malicious. It means the trust decision belongs at each capability boundary. File writes should be resolved and checked by the process that performs them. Native command execution should not be represented by an object reachable from a lower-trust runtime. Network access, secrets and user approvals should be scoped independently.
Engineering lessons from Overpatch
Path validation needs to happen after normalization, symlink resolution and any platform-specific path translation. Prefix comparisons are fragile because similarly named directories and traversal segments can pass superficial checks. The helper should open or create files relative to a trusted directory handle where the operating system supports it, and it should reject links or mount transitions that leave the workspace.
Logging also matters. A privileged patch helper should emit the canonical target, initiating session and authorization result. That produces a boundary audit trail without recording sensitive file contents. Tests should include traversal, symlink swaps, alternate separators and race conditions, not only ordinary paths.
Engineering lessons from Heapjack
Heapjack argues for process separation where the security boundary matters. A shared runtime is convenient and fast, but objects, callbacks and native bindings can become accidental capabilities. Lower-trust code should communicate with a minimal broker over a narrow protocol. The broker can authenticate requests, enforce policy and return constrained results without exposing its own command primitives.
Read-only mode should also be described precisely. It may prevent workspace mutations while leaving network, process, clipboard or credential surfaces unchanged. Product interfaces should show which capabilities are actually disabled so users can make a meaningful risk decision.
A response checklist for teams
Upgrade first, then inventory older executions. Review agent activity involving newly cloned or externally contributed repositories. Look for unexpected writes outside workspaces, unusual child processes, shell activity inconsistent with the task and access to sensitive token stores. Rotate credentials when evidence shows they were exposed; broad rotation without evidence can create operational risk while obscuring the investigation.
Finally, treat the Codex sandbox escapes as an architecture lesson rather than proof that sandboxing is futile. Both reported paths were remediated before disclosure. Strong containment comes from multiple independently enforced layers: input distrust, least privilege, process isolation, canonical path checks, user approvals and observable privileged helpers. The disclosure shows exactly where those layers must not silently share authority.
Facts at a glance
| Fact | Value | Source |
|---|---|---|
| Public disclosure | 15 September 2026 | Accomplish |
| Reported privately | 12 August 2026 | Accomplish |
| Remediation time stated | Within eight days | Accomplish |
| CLI fixed floor | 0.149.0 or later | Accomplish and independent reports |
| Desktop fixed floor | 26.818.21641 or later | Accomplish and independent reports |
| Known exploitation | None publicly reported | Source review |
Related Lapaas Voice coverage
FAQs
Were the Codex sandbox escapes patched before disclosure?
Yes. Accomplish says OpenAI fixed both within eight days of the August 12 report, before the September 15 disclosure.
Which versions are listed as fixed?
Codex CLI 0.149.0 or later and Desktop 26.818.21641 or later.
Was exploitation seen in the wild?
No public evidence of in-the-wild exploitation appeared in the reviewed sources.
Does read-only mode prevent every escape?
No. Read-only constrains file writes; Heapjack reportedly reached a privileged process capability through runtime state.
Sources
- Accomplish disclosure — primary
- BleepingComputer report — independent
- General Analysis guide — independent
- AiCybr report — independent
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
