"Overpatch" and "Heapjack": Two Sandbox Escapes in OpenAI Codex CLI and Codex Desktop

OpenAI Codex CLI and Codex Desktop

Accomplish disclosed two escapes on September 15, 2026. In Codex CLI ("Overpatch"), the `apply_patch` tool granted write access to the parent directories of patched files, so a patch targeting `/tmp` opened `/`, and a symlink let the agent write `$HOME/.zshrc` for unsandboxed execution at the next shell launch, writing anywhere on disk in `workspace-write` mode without an approval prompt. In Codex Desktop ("Heapjack"), the JavaScript tool shared a V8 heap between trusted and untrusted contexts, so untrusted code could pull the authentication token from a heap snapshot and forge requests to the Rust parent process, gaining "unsandboxed command execution, with no prompt" even in `read-only` mode, triggered by opening an untrusted repository and asking Codex a question. Reported August 12 and fixed within eight days, in Codex CLI 0.149.0 and Codex Desktop build 26.818.21641

Sandbox permissions derived from paths the agent controls, and a privileged token stored in memory reachable from the untrusted side of the boundary