AnswersPublished20 sources
How Heapjack and Overpatch Escaped the OpenAI Codex Sandbox
Heapjack and Overpatch could bypass intended Codex boundaries and lead to host level actions from an untrusted repository; update Codex Desktop to build 26.818.21641 or later and Codex CLI to 0.149.0 or later. Heapjack targeted a globally configured node repl helper and shared V8 heap, while Overpatch abused apply p...
Published byEdited with GPT-5.6 TerraImages generated with GPT Image 2
Research answer
Key takeaways
- Heapjack and Overpatch could bypass intended Codex boundaries and lead to host level actions from an untrusted repository; update Codex Desktop to build 26.818.21641 or later and Codex CLI to 0.149.0 or later.
- Heapjack targeted a globally configured node repl helper and shared V8 heap, while Overpatch abused apply patch permissions calculated from paths in an attacker controlled patch.
- Related 2026 agent escapes involving Git configuration had a different mechanism but the same architectural weakness: an unsandboxed orchestration path honored repository controlled input.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: How did Accomplish AI researchers’ Heapjack and Overpatch vulnerabilities enable sandbox escapes and host-command execution in OpenAI’s Code. Article summary: Accomplish’s two findings bypassed Codex’s intended workspace/read-only boundaries by making a trusted enforcement component rely on attacker-influenced state. Both could turn an untrusted repository into host-level code. Topic tags: general, general web. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clic
Codex’s sandbox was intended to limit what an AI coding agent could read, write, and run. Accomplish AI’s Heapjack and Overpatch findings showed that the boundary could still be bypassed when a trusted component either shared a secret with untrusted code or derived privileges from attacker-controlled input. Both issues were reported as patched. 4
8
Heapjack: a shared-heap authorization secret
Heapjack affected the node_repl integration installed by Codex Desktop. According to the researchers, the Desktop app placed its MCP-server configuration in the global ~/.codex/config.toml, meaning CLI sessions using that shared configuration could also inherit the helper. 8
9
The important separation failure was inside the helper’s JavaScript runtime:
- A trusted context retained a per-run authorization token.
- An untrusted, agent-controlled context ran in the same V8 heap.
- The untrusted side could recover the token and use it to make requests the native parent process treated as authorized.
8
15
Because that parent process operated outside the sandbox, the result could be host-level actions—including command execution—even when Codex was nominally in read-only mode. The issue was not simply that JavaScript ran; it was that the credential distinguishing trusted from untrusted work lived in memory accessible to the untrusted side. 8
15
Overpatch: permissions widened by patch content
Overpatch was a Codex CLI issue in apply_patch under workspace-write mode. The tool was supposed to keep edits within the workspace, but its authorization logic granted write scope based on parent directories named in the patch itself. 4
That made the patch’s paths security-sensitive input. Accomplish described a proof of concept in which an otherwise ineffective path such as /tmp caused permission to expand to the filesystem root. A separate patch change then followed a repository-controlled symlink to modify a file outside the workspace, including a shell startup file in the user’s home directory. 4
9
The security consequence was delayed but meaningful: code placed in a shell startup file could execute outside the agent sandbox when the developer later opened a terminal. The bypass did not require the normal approval prompt for the resulting host action. 4
7
The shared flaw: a privileged component trusted the wrong thing
Heapjack and Overpatch used different technical paths, but expose the same design problem: the enforcement mechanism trusted data reachable from the untrusted side of the boundary.
| Issue | What was trusted | Why the boundary failed |
|---|---|---|
| Heapjack | An authorization token in a shared V8 heap | Untrusted code could recover the secret used to distinguish trusted requests. |
| Overpatch | Paths supplied in an agent-controlled patch | Those paths influenced the scope of write permissions rather than merely describing an intended edit. |
This is a confused-deputy problem. A higher-privileged helper or harness performs an action on behalf of lower-trust input without securely validating the authority or final target. Sandboxing the agent’s shell alone is therefore insufficient if helpers, tokens, configuration, and orchestration subprocesses remain privileged or are influenced by repository content.
How Git-based agent escapes fit the pattern
Other 2026 coding-agent sandbox findings were technically distinct but architecturally similar. Accomplish’s Beltdown and Beltdown2 reports described agent shells that were sandboxed while internal Git commands in the surrounding harness ran outside that sandbox. A repository’s .git/config could use Git’s core.fsmonitor setting so that Git executed a configured helper when inspecting the working tree. 17
18
Manifold Security described this broader class as GitSpawn: repository-controlled Git configuration could cause attacker-selected code to run as an agent inspected a project, potentially before a meaningful approval or trust decision. 20
21
The common lesson is not that every repository is automatically dangerous in every workflow. It is that repositories must be treated as potentially active input when tools inspect metadata, resolve symlinks, apply patches, run hooks, or launch helper processes. An agent product’s trust boundary includes all of those paths—not just the visible command tool.
Patched Codex versions
The reported minimum fixed releases are:
- Codex Desktop build 26.818.21641 or later for Heapjack.
9
- Codex CLI version 0.149.0 or later for Overpatch.
4
Accomplish said it reported both issues to OpenAI on August 12, 2026, and that fixes arrived within eight days. 9
What to do before opening an untrusted repository
- Update both the Desktop app and CLI. The two issues affected different components, and the Desktop-installed global helper could affect CLI sessions using shared configuration.
- Treat repository content as more than source code. Symlinks, patch paths, configuration files, hooks, and Git metadata can affect what an agent or its harness does.
20
- Keep sensitive host resources out of the environment. Do not expose long-lived credentials, SSH keys, cloud tokens, Docker sockets, or sensitive home-directory files when evaluating unknown code.
- Use external isolation for genuinely untrusted projects. A disposable VM or similarly strong environment provides a separate boundary if the agent, helper, or harness is compromised.
- Be cautious with repositories delivered intact. GitSpawn-style risks are especially relevant when a project arrives through an archive, shared drive, sync folder, or removable media that preserves
.gitmetadata; an ordinary clone does not normally transfer a remote repository’s local.git/config.22
The practical takeaway is simple: patch the affected Codex components, but do not rely on an in-process sandbox as the only control between an unfamiliar repository and a developer workstation.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "How Heapjack and Overpatch Escaped the OpenAI Codex Sandbox"?
Heapjack and Overpatch could bypass intended Codex boundaries and lead to host level actions from an untrusted repository; update Codex Desktop to build 26.818.21641 or later and Codex CLI to 0.149.0 or later.
What are the key points to validate first?
Heapjack and Overpatch could bypass intended Codex boundaries and lead to host level actions from an untrusted repository; update Codex Desktop to build 26.818.21641 or later and Codex CLI to 0.149.0 or later. Heapjack targeted a globally configured node repl helper and shared V8 heap, while Overpatch abused apply patch permissions calculated from paths in an attacker controlled patch.
What should I do next in practice?
Related 2026 agent escapes involving Git configuration had a different mechanism but the same architectural weakness: an unsandboxed orchestration path honored repository controlled input.
Sources