Two patched Codex sandbox escapes crossed workspace and read-only boundaries

Accomplish AI researcher Oren Yomtov disclosed two vulnerabilities he says were reported to OpenAI on 12 August and fixed within eight days. The first, which he calls Overpatch, affected Codex CLI and could turn a workspace-write session into writes outside the intended project boundary without a new approval. The second, Heapjack, targeted the Codex Desktop JavaScript tool and is reported to have turned a strict read-only session into unsandboxed command execution.

The disclosure says the affected paths were different rather than one exploit chain. Overpatch abused filesystem permission derivation around apply_patch. Heapjack attacked the trust boundary between restricted JavaScript execution and the more privileged Desktop parent process. Yomtov lists Codex CLI 0.149.0 and Codex Desktop build 26.818.21641 as the first fixed versions and says later releases contain the corrections.

OpenAI’s public Codex repository contains a 20 August commit titled “Prevent apply_patch from widening write permissions.” The commit says deriving permissions from the parent of an already-writable patch target could unnecessarily grant write access outside the intended workspace. The fix skips targets already covered by the active filesystem policy before deriving any additional parent-directory permission.

OpenAI also added regression coverage for workspace-directory targets, already-writable parents and symlink escapes outside the workspace. That matches the core Overpatch mechanism described by Accomplish: a harmless-looking target inside the writable project could influence the permission calculation, after which a symlinked path could be used to reach a file outside the workspace.

For Heapjack, Accomplish says Codex Desktop configured a Node REPL service whose trusted and untrusted V8 contexts still shared a process heap. The researcher reports that code running in the restricted context could take a heap snapshot, recover a UUID-like capability used on the shared pipe and then issue messages understood by the privileged parent process.

According to the disclosure, that parent process exposed capabilities including launching system applications, connecting to Unix sockets and editing Codex configuration, making the escape possible even from a read-only agent session. OpenAI has not published a separate public advisory or patch note reviewed for this story that independently documents Heapjack’s mechanism or maps it to the cited Desktop build.

The story is Corroborated because OpenAI’s own source history independently establishes the apply_patch permission-widening defect and its fix, while the second Desktop issue and both minimum fixed-version claims remain tied to the researcher disclosure. No source reviewed for this article documents exploitation against users in the wild. The practical version boundary from the disclosure is therefore useful remediation information, but it should not be treated as a first-party OpenAI incident advisory for both flaws.