OpenAI Codex sandbox researchers disclosed two escapes on 20 September 2026—one capable of running host commands from Codex’s strictest read-only mode with no approval prompt. Both flaws were reported to OpenAI on 12 August and fixed within eight days, according to Oren Yomtov of Accomplish AI as reported by BleepingComputer. If you ship with Codex Desktop or the CLI, the practical answer is: update past the patched builds below.
This is a coding-agent containment story, not a twin of today’s Gemini test-breakout coverage already live on this site.
What broke: Heapjack and Overpatch
Heapjack (more serious): Codex Desktop writes a `node_repl` tool into global `~/.codex/config.toml` at install time—no opt-in. Trusted and untrusted JavaScript share one Node process and one memory heap. Untrusted code snapshots the heap with `v8.getHeapSnapshot()`, recovers the trusted UUID token, and speaks to the unsandboxed parent over the same pipe. Proof-of-concept used the system `open` command; the same access reaches Unix sockets (including a Docker daemon socket) and config edits—all from read-only mode.
Overpatch (Codex CLI, workspace-write mode): `apply_patch` grants write access to the *parent* of each path named in a patch. Naming `/tmp` widens write access to disk root; a second change can append to `.zshrc` via a home-directory symlink. Next terminal session runs the attacker’s line unsandboxed.
Both bugs share a shape BleepingComputer emphasises: enforcement lived inside the thing it was meant to enforce.
Fixed versions — update checklist
Per Accomplish via BleepingComputer:
- Codex Desktop: build 26.818.21641 or later (Heapjack) - Codex CLI: 0.149.0 or later (Overpatch)
Users should update to those versions or later. BleepingComputer noted it reached out to OpenAI for comment before publishing; treat vendor advisories as the source of truth if OpenAI posts a formal security note after this desk’s publish time.
People also ask: is this the same as the Gemini hack?
No. The Gemini story covered on this site concerns a May Irregular capture-the-flag test where a model reached real company systems. Codex Heapjack/Overpatch are local developer-tool sandbox escapes in OpenAI’s coding agent—different product, different failure mode, same broader lesson that agent sandboxes are hard.
July 2026 Pillar Security research (cited by BleepingComputer) showed a related pattern across Cursor, Codex, Gemini CLI and Google Antigravity: an agent stays “inside” the sandbox by writing a file a trusted tool outside later runs. That is context, not a claim that today’s Codex bugs are identical.
Why this ranks today
Developer security SEO spikes the day a named CVE-class writeup lands with fix versions: “OpenAI Codex sandbox”, “Codex Heapjack”, and “Codex CLI 0.149.0” travel together. A BREAKING explainer that answers *what / how bad / which build to install / how it differs from Gemini* outperforms vague “AI unsafe” essays.
This piece deepens Technology explainers beside Surface, Disney CTO, Gemini and Kojima pieces—same cluster, distinct product and date.
Practical hardening beyond the patch
Updating Desktop and CLI is the mandatory step. Teams that leave Codex pointed at untrusted repositories should also treat third-party repos as hostile until reviewed: Heapjack’s scary path was “open someone else’s repo, ask a question, get host RCE.” Disable unused agent tools where your org policy allows, keep Docker sockets off developer laptops that run coding agents, and rotate any secrets that lived in shell rc files if you were on vulnerable CLI builds while testing untrusted patches.
This desk will not reproduce exploit payloads—only the defender checklist published via BleepingComputer’s summary of Accomplish’s report.
Related Sunday Profile coverage
Deepen Technology explainers with our Gemini unauthorized access (https://www.thesundayprofile.com/gemini-unauthorized-access-hack) BREAKING guide and Kojima Physint Sony (https://www.thesundayprofile.com/kojima-physint-sony) Technology explainer—adjacent platform-risk and industry-structure coverage without twinning Codex search intent.
Sources: BleepingComputer, Ax Sharma (20 Sept 2026 — Heapjack/Overpatch, fix builds, Accomplish timeline); Accomplish AI / Oren Yomtov writeup as summarised by BC; Pillar Security July 2026 class of bugs cited for context only.