--- title: Codex Sandbox Escapes Show Why Agent Guardrails Can’t... description: Security researchers at Accomplish AI disclosed two sandbox-escape vulnerabilities in OpenAI Codex, dubbed Heapjack and Overpatch. Heapjack let untrusted code... canonical: https://daily.dev/posts/codex-sandbox-escapes-show-why-agent-guardrails-can-t-live-inside-the-agent-iotcpujky twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Codex Sandbox Escapes Show Why Agent Guardrails Can’t Live Inside the Agent | daily.dev og:description: Security researchers at Accomplish AI disclosed two sandbox-escape vulnerabilities in OpenAI Codex, dubbed Heapjack and Overpatch. Heapjack let untrusted code... og:url: https://daily.dev/posts/codex-sandbox-escapes-show-why-agent-guardrails-can-t-live-inside-the-agent-iotcpujky og:image: https://api.daily.dev/og/posts/IOtCPuJky.png og:image:alt: Codex Sandbox Escapes Show Why Agent Guardrails Can’t Live Inside the Agent og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Codex Sandbox Escapes Show Why Agent Guardrails Can’t Live Inside the Agent **[DevOps.com](https://daily.dev/sources/devops)** · 6 min read · 0 upvotes · 0 comments ## Summary Security researchers at Accomplish AI disclosed two sandbox-escape vulnerabilities in OpenAI Codex, dubbed Heapjack and Overpatch. Heapjack let untrusted code extract a trust token from a shared V8 memory heap to execute unsandboxed commands even in Codex's strictest read-only mode. Overpatch abused the apply_patch tool's directory permission logic to write outside the workspace, modifying files like .zshrc to run code on shell startup. Both were reported on August 12, 2026 and patched by OpenAI within eight days. Fixes ship in Codex CLI 0.149.0 and Codex Desktop build 26.818.21641. The piece argues the root cause is architectural: enforcement logic lived inside the same environment it was meant to restrict, echoing earlier sandbox-escape findings across Cursor, Gemini CLI, Google Antigravity, and Claude Code. Recommended mitigations include treating unfamiliar repositories as untrusted input, not relying on approval prompts, and running agents inside isolated VMs with credentials kept outside the sandbox. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are the Heapjack and Overpatch vulnerabilities in OpenAI Codex? Heapjack and Overpatch are two sandbox-escape flaws disclosed by Accomplish AI researcher Oren Yomtov. Heapjack let untrusted code read a trust token from a shared V8 memory heap in Codex Desktop's node_repl helper, enabling unsandboxed command execution even in read-only mode. Overpatch exploited Codex CLI's apply_patch tool, which granted overly broad write permissions based on a path's parent directory, allowing writes to files like .zshrc outside the workspace. _Anyone running Codex in CI or on developer machines should track fixes like these on daily.dev before shipping agent-based workflows._ ### Which Codex CLI and Desktop versions fix the Heapjack and Overpatch sandbox escapes? The fixes ship in Codex CLI 0.149.0 or later and Codex Desktop build 26.818.21641 or later. Both flaws were reported to OpenAI on August 12, 2026, and patched within eight days, with details published by Accomplish AI on September 15. Teams should check both the desktop app and CLI separately since they carry independent version numbers. _Teams standardizing agent tooling versions can follow patch timelines like this via daily.dev._ ### Does read-only mode protect against Codex sandbox escapes? No, read-only mode did not stop the Heapjack exploit. Untrusted code in a cloned repository could still extract a trust token from shared memory and trigger unsandboxed command execution even under Codex's strictest read-only setting, meaning approval prompts and mode restrictions alone are not reliable security boundaries. _Developers weighing how much to trust AI coding agent sandboxes can track findings like this on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#appsec](https://daily.dev/tags/appsec), [#devsecops](https://daily.dev/tags/devsecops), [#openai-codex](https://daily.dev/tags/openai-codex) [View this post on daily.dev](https://daily.dev/posts/codex-sandbox-escapes-show-why-agent-guardrails-can-t-live-inside-the-agent-iotcpujky) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Codex Sandbox Escapes Show Why Agent Guardrails Can’t Live Inside the Agent","url":"https://daily.dev/posts/codex-sandbox-escapes-show-why-agent-guardrails-can-t-live-inside-the-agent-iotcpujky","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/codex-sandbox-escapes-show-why-agent-guardrails-can-t-live-inside-the-agent-iotcpujky"},"datePublished":"2026-09-21T15:35:10.217Z","dateModified":"2026-09-21T15:36:39.480Z","description":"Security researchers at Accomplish AI disclosed two sandbox-escape vulnerabilities in OpenAI Codex, dubbed Heapjack and Overpatch. Heapjack let untrusted code...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6afcaed00ad072edaf4252f5e295c88a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6afcaed00ad072edaf4252f5e295c88a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"DevOps.com","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"DevOps.com","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/db8f2265cff0416c878c6e7e92bb8715","url":"https://daily.dev/sources/devops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/codex-sandbox-escapes-show-why-agent-guardrails-can-t-live-inside-the-agent-iotcpujky","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,appsec,devsecops,openai-codex","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DevOps.com","item":"https://daily.dev/sources/devops"},{"@type":"ListItem","position":3,"name":"Codex Sandbox Escapes Show Why Agent Guardrails Can’t Live Inside the Agent"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/codex-sandbox-escapes-show-why-agent-guardrails-can-t-live-inside-the-agent-iotcpujky#faq","mainEntity":[{"@type":"Question","name":"What are the Heapjack and Overpatch vulnerabilities in OpenAI Codex?","acceptedAnswer":{"@type":"Answer","text":"Heapjack and Overpatch are two sandbox-escape flaws disclosed by Accomplish AI researcher Oren Yomtov. Heapjack let untrusted code read a trust token from a shared V8 memory heap in Codex Desktop's node_repl helper, enabling unsandboxed command execution even in read-only mode. Overpatch exploited Codex CLI's apply_patch tool, which granted overly broad write permissions based on a path's parent directory, allowing writes to files like .zshrc outside the workspace. Anyone running Codex in CI or on developer machines should track fixes like these on daily.dev before shipping agent-based workflows."}},{"@type":"Question","name":"Which Codex CLI and Desktop versions fix the Heapjack and Overpatch sandbox escapes?","acceptedAnswer":{"@type":"Answer","text":"The fixes ship in Codex CLI 0.149.0 or later and Codex Desktop build 26.818.21641 or later. Both flaws were reported to OpenAI on August 12, 2026, and patched within eight days, with details published by Accomplish AI on September 15. Teams should check both the desktop app and CLI separately since they carry independent version numbers. Teams standardizing agent tooling versions can follow patch timelines like this via daily.dev."}},{"@type":"Question","name":"Does read-only mode protect against Codex sandbox escapes?","acceptedAnswer":{"@type":"Answer","text":"No, read-only mode did not stop the Heapjack exploit. Untrusted code in a cloned repository could still extract a trust token from shared memory and trigger unsandboxed command execution even under Codex's strictest read-only setting, meaning approval prompts and mode restrictions alone are not reliable security boundaries. Developers weighing how much to trust AI coding agent sandboxes can track findings like this on daily.dev."}}]} ```