OpenAI Codex sandbox: Overpatch + Heapjack escapes (reported 12 Aug; fixed in eight days)
Accomplish / Boundary-Bench researchers (public write-up dated 15 September 2026) disclosed two escapes from the OpenAI Codex agent sandbox, reported to OpenAI on 12 August 2026 and fixed within eight days. Overpatch (Codex CLI, open-source harness): the apply_patch tool grants write access to the parent of each path named in a patch; including a no-op path under /tmp widens the grant to /, so a crafted patch can append to ~/.zshrc (via symlink) without an approval prompt in normal agent/workspace-write mode, then run unsandboxed on the next shell. Heapjack (Codex Desktop): install writes an [mcp_servers.node_repl] block into ~/.codex/config.toml (no opt-out), spawning a Node REPL with trusted and untrusted V8 contexts sharing one heap; the trusted-context token was readable from the shared heap, enabling unsandboxed command execution even from read-only mode. Primary: Accomplish blog; no separate CVE IDs cited in the write-up. Operators running Codex CLI/Desktop should ensure they are on post-fix builds from OpenAI after mid-August 2026.
- Product
- OpenAI Codex CLI and Codex Desktop (agent sandbox / apply_patch / node_repl)
- Versions
- Vulnerable builds prior to OpenAI fixes shipped within eight days of 12 Aug 2026 report; use current vendor releases
- Exploited in Australia?
- unknown
- Patch to
- Upgrade Codex CLI/Desktop to OpenAI builds that include the post-12 Aug 2026 sandbox fixes; review unexpected ~/.codex/config.toml mcp_servers.node_repl and shell rc changes
Primary: Accomplish — Escaping the OpenAI Codex sandbox, twice (15 Sep 2026) · Vendor: Accomplish / Boundary-Bench disclosure (OpenAI fixed within eight days of 12 Aug report) · talkback.sh wire listing (Accomplish Codex sandbox post)