How Heapjack and Overpatch Escaped the Codex Sandbox

A developer did not have to approve a command for these attacks to matter. Accomplish AI found that attacker-controlled repository content could reach Codex components with more authority than the repository itself should have had. The two flaws crossed that boundary in different ways: Heapjack reached the host from read-only mode, while Overpatch bypassed workspace write limits. 26

Heapjack: command execution from read-only mode

Heapjack affected node_repl, a JavaScript helper installed by Codex Desktop and made available through configuration that CLI sessions could also use. Trusted and untrusted JavaScript ran in separate contexts but shared a Node.js process and memory heap. Researchers found that untrusted code could recover the in-memory secret used to identify trusted code, then use that authority to trigger unsandboxed commands on the developer’s machine. 819

That made read-only mode an insufficient safeguard for this path. In the researchers’ scenario, asking Codex to examine a malicious repository could expose the developer’s host even though the session was not supposed to write files. 27

Overpatch: writes beyond the workspace

Overpatch affected Codex CLI’s apply_patch path in workspace-write mode. A crafted patch could cause the tool to write outside the permitted project directory without an approval prompt. That is a different outcome from Heapjack’s direct unsandboxed command execution, but an out-of-workspace write could also become a route to later command execution—for example, by changing a shell startup file. 269

The shared failure—and what to do

Both attacks depended on attacker-influenced input reaching a privileged helper whose own checks were treated as the security boundary. Heapjack undermined the helper’s distinction between trusted and untrusted code; Overpatch undermined limits on where the patch helper could write. Read-only and workspace-write settings did not contain those particular paths. 289

Accomplish AI says it reported both flaws to OpenAI on August 12, 2026, and that both were fixed within eight days. The identified fixed versions are Codex Desktop build 26.818.21641 for Heapjack and Codex CLI 0.149.0 for Overpatch. If you use both, check and update both: a Desktop-installed helper could also be available to CLI sessions. When examining a repository you do not trust, do not treat read-only mode alone as isolation; use an isolated environment, particularly if you have not yet updated. 1278