Codex Sandbox Escapes Allowed Unauthorized File Access and Command Execution
Two separate sandbox escapes were found in OpenAI's Codex coding agent and reported to the vendor on 12 August 2026. Both issues were fixed within eight days. The first flaw, called Overpatch, affects the open-source Codex CLI. It allows the built-in patch tool to gain write access across the entire disk when running in the standard workspace-write mode, without showing an approval prompt. The second flaw, called Heapjack, affects the JavaScript execution tool that Codex Desktop installs. It can lead to fully unsandboxed command execution even when the agent is running in read-only mode, the strictest available setting. Anyone using Codex CLI or Codex Desktop on a developer workstation was potentially affected. Because the desktop installer adds a global configuration entry, CLI users could also inherit the vulnerable tool without explicitly installing it. Neither escape required user interaction beyond opening a repository and asking the agent a question.
Overpatch abuses how the apply_patch tool determines its permissions. For each file in a patch, the tool gives itself write access to that file's parent directory. By including /tmp, the tool could end up granting write access to the filesystem root. The proof of concept used two changes in one patch: one modified the user's .zshrc through a symlink to the home directory, while another deliberately failed change referenced /tmp to expand the permissions. Without the /tmp entry, the write was blocked. With it, the .zshrc file could be modified, causing attacker-controlled commands to run when the next terminal session started.
Heapjack uses a different approach. The node_repl tool is a native Rust program that starts a sandboxed Node process with two V8 contexts: one trusted context and one running the agent's code. The two contexts are separated by a random authorization token. However, because they share the same heap, untrusted code can use v8.getHeapSnapshot to find UUID-like strings and identify the token. Both contexts also share the same stdout pipe with the Rust parent process. The untrusted code can therefore send a correctly formatted request containing the recovered token. The parent process accepts the request and can then launch applications outside the Codex process tree, connect to Unix sockets such as the Docker daemon socket, and modify the global Codex configuration.
The main issue shared by both vulnerabilities is how the security boundary was implemented. In both cases, components responsible for enforcing the boundary were running within the environment they were supposed to protect. The apply_patch tool could derive its own permissions from attacker-controlled input, while node_repl stored its authorization token in memory that untrusted code could access. In practice, opening an untrusted repository and asking Codex a normal question could allow repository content to gain access beyond the sandbox without an approval prompt. This creates a potential supply chain risk because the malicious content can be hidden in an otherwise normal-looking repository. The demonstrated techniques also include modifying shell startup files and accessing the Docker daemon socket. Both vulnerabilities were disclosed through coordinated disclosure and fixed by the vendor. The findings highlight the importance of carefully isolating security-sensitive components in autonomous coding agents and limiting the tools installed or enabled by default.
Attack Surface
Endpoint, Supply Chain (Third-party vendors), Workspace
Tactics
Execution, Privilege Escalation, Defense Evasion, Credential Access, Persistence, Initial Access
Techniques
- T1611 – Escape to Host
- T1211 – Exploitation for Defense Evasion
- T1059.004 – Command and Scripting Interpreter: Unix Shell
- T1546.004 – Event Triggered Execution: Unix Shell Configuration Modification
- T1552 – Unsecured Credentials
- T1195.001 – Supply Chain Compromise: Compromise Software Dependencies and Development Tools
- T1548 – Abuse Elevation Control Mechanism
SuperPRO's Threat Countermeasures Procedures
- Update the Codex CLI and Codex Desktop to the builds released after 20 August 2026, which contain the vendor fixes for the apply_patch parent-directory grant (Overpatch) and the node_repl token isolation flaw (Heapjack).
- Inspect ~/.codex/config.toml on every developer workstation and remove the [mcp_servers.node_repl] block if the Node REPL tool is not required, since Codex Desktop writes this entry globally at install time with no opt-in and the plain CLI inherits it.
- Enable file integrity monitoring or EDR file-write alerts on shell startup files, specifically ~/.zshrc, ~/.bashrc, ~/.zprofile and ~/.bash_profile, and treat any write originating from a codex or apply_patch process as high priority.
- Alert on the macOS open command or launchd spawning applications where the parent chain includes a codex or node_repl process, as this is the exact behaviour the Heapjack proof of concept used to start processes outside the Codex process tree.
- Restrict access to the Docker daemon socket at /var/run/docker.sock using filesystem ACLs or socket proxying, and alert on connections to it from developer tooling processes, since the forged node_repl token permits connections to arbitrary unix sockets.
- Run AI coding agents inside a disposable virtual machine or dedicated container host rather than directly on the developer endpoint, so that any in-process sandbox escape is contained to the guest and cannot reach the host filesystem.
- Keep real credentials and cloud tokens out of the agent environment by substituting placeholders and routing outbound traffic through a host-side proxy that the agent cannot reconfigure, so a successful escape yields no usable secrets.
