OpenAI Codex: Two Sandbox Escapes, apply_patch "Overpatch" in Codex CLI and "Heapjack" Token Leak in the Codex Desktop JavaScript Tool

Accomplish principal security researcher Oren Yomtov published two Codex sandbox escapes on 15 September 2026, after reporting both to OpenAI on 12 August; OpenAI fixed both within eight days. Overpatch (Codex CLI): the apply_patch tool granted write access to the parent folder of every path named in a patch, so naming /tmp granted write access to /, and in workspace-write mode the agent could write into $HOME (for example .zshrc via a symlink) with no prompt and get unsandboxed execution the next time a terminal opened. Heapjack (Codex Desktop): trusted and untrusted JavaScript in the installed JavaScript tool shared one V8 heap, so untrusted code could take a heap snapshot, read the secret token that marks trusted code and send requests the native parent accepted, giving unsandboxed command execution even in read-only mode, unix-socket access such as the Docker daemon, and edits to ~/.codex/config.toml. The global config Codex Desktop writes also hands the plain Codex CLI the same JavaScript tool. Fixed in Codex CLI 0.149.0 (Overpatch) and Codex Desktop build 26.818.21641 (Heapjack). No CVE IDs or CVSS scores were published.

You are affected if you run Codex CLI before 0.149.0 (Overpatch); Codex Desktop before build 26.818.21641 (Heapjack), plus Codex CLI installs that received the JavaScript tool through the Desktop-written global config.. Versions 0.149.0 and later include the fix.

Update Codex CLI to 0.149.0+ and Codex Desktop to build 26.818.21641+ across the fleet. On machines that ran older versions, check shell startup files such as .zshrc and ~/.codex/config.toml for changes nobody made. Do not rely on workspace-write or read-only sandbox modes as the only boundary when an agent processes untrusted repositories: run agents in a VM or container holding no real credentials, with outbound traffic through a controlled proxy, which Accomplish says contains both bugs.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Codex CLI and which version, then enforce a policy on it.