Two vulnerabilities have been discovered in OpenAI Codex—dubbed “Overpatch” and “Heapjack”—that allowed attacker-controlled repositories to execute commands on a developer’s machine, bypassing sandbox protections. These flaws were reported on August 12, 2026, and patched within a week. Codex users should update immediately to avoid exposure.
Overpatch: Writing Outside the Project Directory
The Overpatch issue stemmed from a flaw in the Codex CLI and its apply_patchtool. The vulnerability misused parent directory paths provided in patches. By inserting a directory like “/tmp” in a patch, write permissions were mistakenly allowed from the system root, not confined to the intended project folder. As a proof of concept, an attacker created a symbolic link to append malicious code into a user’s .zshrc, enabling the code to run when a new terminal was opened.
Heapjack: Bypassing Read-only Mode
Heapjack affected Codex Desktop’s node_replcomponent. Although Codex is supposed to isolate untrusted content in a read-only sandbox, this flaw exposed a trusted authorization token via shared V8 heap memory between trusted and untrusted contexts. Attackers could dump the heap, extract the token, and send forged requests through stdout to break out of the sandbox—potentially running host commands and accessing system-level resources like Unix sockets or the Docker daemon.
Scope, Patches, and Recommendations
The Overpatch flaw impacted the Codex CLI’s workspace-write sandbox mode, while Heapjack compromised read-only operations in the Desktop application. Neither flaw required any user approval prompts for execution. Overpatch was resolved in Codex CLI version 0.149.0 or later. Heapjack was fixed in Codex Desktop build 26.818.21641.
Users should update both Codex Desktop and CLI, especially if they work with third-party or untrusted repositories. It is also vital not to rely on read-only mode or perceived isolation as full protection—enforcement logic and tokens must be kept out of reach from untrusted content.
These vulnerabilities highlight broader risks around security boundaries in AI-powered tooling. Even sandboxed agents are vulnerable if internal authorization is exposed or write permissions are misrouted. Developers and organizations must treat AI agents as risk mitigators—not perfect guards—and audit or limit untrusted inputs rigorously.
