Skip to content
AgentProv

2026-09-15 · 2026-Q3

"Overpatch" and "Heapjack": Two Sandbox Escapes in OpenAI Codex CLI and Codex Desktop

Primary layerL6 Identity / RunSecondary:L5 Config

Which agent, run, or tenant is this?

The question layer 6 asks, and failed here.
Fixable
Vendor patch
Vendor response
Patched
In the wild
No
Actor
Attacker

Target

OpenAI Codex CLI and Codex Desktop

Impact

Accomplish disclosed two escapes on September 15, 2026. In Codex CLI ("Overpatch"), the `apply_patch` tool granted write access to the parent directories of patched files, so a patch targeting `/tmp` opened `/`, and a symlink let the agent write `$HOME/.zshrc` for unsandboxed execution at the next shell launch, writing anywhere on disk in `workspace-write` mode without an approval prompt. In Codex Desktop ("Heapjack"), the JavaScript tool shared a V8 heap between trusted and untrusted contexts, so untrusted code could pull the authentication token from a heap snapshot and forge requests to the Rust parent process, gaining "unsandboxed command execution, with no prompt" even in `read-only` mode, triggered by opening an untrusted repository and asking Codex a question. Reported August 12 and fixed within eight days, in Codex CLI 0.149.0 and Codex Desktop build 26.818.21641

Root cause

Sandbox permissions derived from paths the agent controls, and a privileged token stored in memory reachable from the untrusted side of the boundary

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: "Overpatch" and "Heapjack": Two Sandbox Escapes in OpenAI Codex CLI and Codex Desktop (2026-09-15). https://agentprov.com/incidents/2026-09-15-overpatch-and-heapjack-two-sandbox-escapes-in-openai-codex-cli-and-codex-desktop

Related