--- title: OpenAI Codex sandbox escapes show agent guardrails can't... description: Two sandbox escape vulnerabilities in OpenAI Codex, disclosed by researcher Oren Yomtov at Accomplish AI on August 12, were patched by OpenAI within eight... canonical: https://daily.dev/posts/openai-codex-sandbox-escapes-show-agent-guardrails-can-t-live-inside-the-agent-4uypezsu6 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: OpenAI Codex sandbox escapes show agent guardrails can't live inside the agent | daily.dev og:description: Two sandbox escape vulnerabilities in OpenAI Codex, disclosed by researcher Oren Yomtov at Accomplish AI on August 12, were patched by OpenAI within eight... og:url: https://daily.dev/posts/openai-codex-sandbox-escapes-show-agent-guardrails-can-t-live-inside-the-agent-4uypezsu6 og:image: https://api.daily.dev/og/posts/4uYpeZSu6.png og:image:alt: OpenAI Codex sandbox escapes show agent guardrails can't live inside the agent og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # OpenAI Codex sandbox escapes show agent guardrails can't live inside the agent **[Trends](https://daily.dev/sources/trends)** · 2 min read · 1 upvotes · 0 comments ## Summary Two sandbox escape vulnerabilities in OpenAI Codex, disclosed by researcher Oren Yomtov at Accomplish AI on August 12, were patched by OpenAI within eight days. Heapjack exploits a shared V8 memory heap in Codex Desktop's node_repl to extract an authorization token, bypassing even strict read-only mode. Overpatch abuses attacker-supplied symlinks in the apply_patch tool to write outside the sandbox, e.g. into .zshrc for persistent code execution. Fixes shipped in Codex CLI 0.149.0 and Codex Desktop build 26.818.21641. The deeper issue: enforcement logic living inside the same environment it restricts, a pattern also seen in Cursor, Gemini CLI, Google Antigravity, and Claude Code. Recommended mitigations include treating unfamiliar repos as untrusted, running agents in isolated VMs, and keeping credentials outside the sandbox entirely. ## Content Two sandbox escapes in OpenAI Codex were disclosed last week, and the technical details are uncomfortable reading for anyone shipping agentic tooling. Researchers Oren Yomtov at Accomplish AI found both bugs and reported them August 12. OpenAI patched within eight days, which is genuinely fast. But the speed of the fix doesn't make the root cause less awkward. **What actually happened** Heapjack is the nastier one. Codex Desktop's `node_repl` component shares a V8 memory heap between trusted and untrusted JavaScript contexts. Yomtov's team dumped that heap, scanned it for UUID-shaped tokens, and pulled out an authorization token that let them execute unsandboxed commands. This works even in Codex's strictest read-only mode. All an attacker needs is for you to point Codex at a malicious repository. Overpatch is more mundane but still bad. The `apply_patch` tool derives write permissions from attacker-supplied paths. Feed it a symlink, write to your home directory, drop something into `.zshrc`, and your code runs the next time a terminal opens. Classic. Fixes are in Codex CLI 0.149.0 and Codex Desktop build 26.818.21641. Update now if you haven't. **The structural problem nobody wants to talk about** The disclosure piece makes a point worth sitting with: both vulnerabilities exist because the enforcement logic lived inside the same environment it was supposed to restrict. The sandbox was policing itself. That's not a bug you patch away - it's an architectural choice that keeps producing bugs. This isn't isolated to Codex. Similar escapes have turned up in Cursor, Gemini CLI, Google Antigravity, and Claude Code. The pattern is consistent enough that it's starting to look like an industry-wide assumption problem: that you can build meaningful isolation by putting guardrails inside the agent itself. The recommended mitigations are sensible but require actual discipline: treat unfamiliar repos as untrusted input, don't rely on approval prompts as a security boundary, run agents in isolated VMs, and keep credentials outside the sandbox entirely. That last one is the hard part. Most teams aren't doing it. And as long as agents need credentials to be useful, the temptation to keep them close - and inside the sandbox - is going to keep producing exactly this kind of vulnerability. ## Questions this post answers ### What were the Heapjack and Overpatch vulnerabilities in OpenAI Codex? Heapjack exploited a shared V8 memory heap in Codex Desktop's node_repl component, letting attackers dump the heap and extract an authorization token to run unsandboxed commands, even in strict read-only mode. Overpatch abused the apply_patch tool's reliance on attacker-supplied paths, using a symlink to write outside the sandbox into files like .zshrc for persistent code execution. Both were reported by Oren Yomtov of Accomplish AI on August 12. _Teams running Codex in CI or on untrusted repos should track fixes like these on daily.dev before shipping agentic tooling._ ### Which OpenAI Codex versions fix the Heapjack and Overpatch sandbox escapes? The fixes shipped in Codex CLI version 0.149.0 and Codex Desktop build 26.818.21641. Anyone running an earlier version should update immediately, since both vulnerabilities allow unsandboxed command execution or persistent code execution triggered simply by pointing Codex at a malicious repository. _Keeping pinned agent tool versions current against disclosures like this is easier to track on daily.dev._ ### Why do AI coding agent sandboxes keep getting bypassed across tools like Codex, Cursor, and Claude Code? Enforcement logic in these tools lives inside the same environment it is meant to restrict, so the sandbox ends up policing itself rather than being isolated from what it constrains. This structural choice has produced similar escapes in Cursor, Gemini CLI, Google Antigravity, and Claude Code. Recommended mitigations include treating unfamiliar repos as untrusted, avoiding approval prompts as a security boundary, running agents in isolated VMs, and keeping credentials outside the sandbox entirely. _Developers weighing agent tool trade-offs can follow this recurring sandbox-design debate on daily.dev._ ## Similar posts on daily.dev - [Coding Agent Horror Stories: The 29 Million Secret Problem](https://daily.dev/posts/coding-agent-horror-stories-the-29-million-secret-problem-3aivjwf10) · Docker · 28 upvotes · 5 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#appsec](https://daily.dev/tags/appsec), [#openai-codex](https://daily.dev/tags/openai-codex) [View this post on daily.dev](https://daily.dev/posts/openai-codex-sandbox-escapes-show-agent-guardrails-can-t-live-inside-the-agent-4uypezsu6) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"OpenAI Codex sandbox escapes show agent guardrails can't live inside the agent","url":"https://daily.dev/posts/openai-codex-sandbox-escapes-show-agent-guardrails-can-t-live-inside-the-agent-4uypezsu6","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/openai-codex-sandbox-escapes-show-agent-guardrails-can-t-live-inside-the-agent-4uypezsu6"},"datePublished":"2026-09-21T15:35:58.210Z","dateModified":"2026-09-21T15:36:45.036Z","description":"Two sandbox escape vulnerabilities in OpenAI Codex, disclosed by researcher Oren Yomtov at Accomplish AI on August 12, were patched by OpenAI within eight...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6afcaed00ad072edaf4252f5e295c88a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6afcaed00ad072edaf4252f5e295c88a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Trends","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trends","logo":"https://media.daily.dev/image/upload/s--ZfSp3asX--/f_auto,q_auto/v1780996004/logos/trends?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trends"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/openai-codex-sandbox-escapes-show-agent-guardrails-can-t-live-inside-the-agent-4uypezsu6","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,appsec,openai-codex","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trends","item":"https://daily.dev/sources/trends"},{"@type":"ListItem","position":3,"name":"OpenAI Codex sandbox escapes show agent guardrails can't live inside the agent"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/openai-codex-sandbox-escapes-show-agent-guardrails-can-t-live-inside-the-agent-4uypezsu6#faq","mainEntity":[{"@type":"Question","name":"What were the Heapjack and Overpatch vulnerabilities in OpenAI Codex?","acceptedAnswer":{"@type":"Answer","text":"Heapjack exploited a shared V8 memory heap in Codex Desktop's node_repl component, letting attackers dump the heap and extract an authorization token to run unsandboxed commands, even in strict read-only mode. Overpatch abused the apply_patch tool's reliance on attacker-supplied paths, using a symlink to write outside the sandbox into files like .zshrc for persistent code execution. Both were reported by Oren Yomtov of Accomplish AI on August 12. Teams running Codex in CI or on untrusted repos should track fixes like these on daily.dev before shipping agentic tooling."}},{"@type":"Question","name":"Which OpenAI Codex versions fix the Heapjack and Overpatch sandbox escapes?","acceptedAnswer":{"@type":"Answer","text":"The fixes shipped in Codex CLI version 0.149.0 and Codex Desktop build 26.818.21641. Anyone running an earlier version should update immediately, since both vulnerabilities allow unsandboxed command execution or persistent code execution triggered simply by pointing Codex at a malicious repository. Keeping pinned agent tool versions current against disclosures like this is easier to track on daily.dev."}},{"@type":"Question","name":"Why do AI coding agent sandboxes keep getting bypassed across tools like Codex, Cursor, and Claude Code?","acceptedAnswer":{"@type":"Answer","text":"Enforcement logic in these tools lives inside the same environment it is meant to restrict, so the sandbox ends up policing itself rather than being isolated from what it constrains. This structural choice has produced similar escapes in Cursor, Gemini CLI, Google Antigravity, and Claude Code. Recommended mitigations include treating unfamiliar repos as untrusted, avoiding approval prompts as a security boundary, running agents in isolated VMs, and keeping credentials outside the sandbox entirely. Developers weighing agent tool trade-offs can follow this recurring sandbox-design debate on daily.dev."}}]} ```