AI coding agents are increasingly trusted with source code, files, development tools and command execution.
That makes the security boundaries around these systems critical.
Researchers from Accomplish AI identified two vulnerabilities in OpenAI Codex that demonstrated ways to cross intended sandbox boundaries and execute commands on the host system.
The vulnerabilities, named Heapjack and Overpatch, were reported to OpenAI on August 12, 2026. According to the researchers, OpenAI addressed the issues within eight days.
This article covers the publicly disclosed technical findings and demonstrated behavior.
1. Two Vulnerabilities, Two Attack Paths
The researchers identified two distinct vulnerabilities:
- Heapjack — a sandbox escape involving trusted and untrusted JavaScript execution contexts and an authentication token.
- Overpatch — a filesystem boundary issue involving Codex’s patch mechanism.
The vulnerabilities affected different components and used different techniques.
2. Heapjack: Recovering a Trusted Token
Heapjack targeted Codex’s node_repl component.
The component contains trusted and untrusted JavaScript execution contexts within the same Node.js process.
The trusted context possesses an authentication token used to communicate with a native parent process operating outside the sandbox.
The researchers discovered that code executing in the untrusted context could obtain a V8 heap snapshot.
They were then able to search the snapshot for strings matching the format of the authentication token.
According to the researchers, recovering the token allowed the untrusted code to authenticate to the privileged parent process.
This provided a route from the sandboxed environment to functionality belonging to the host-side process.
3. Demonstrated Host Command Execution
After obtaining the token, the researchers demonstrated communication with the privileged parent process.
Their proof of concept successfully invoked the host operating system’s open command.
The demonstrated sequence was:
Untrusted code → token recovery → privileged parent process → host command
The researchers reported that this technique worked even when Codex was configured in read-only mode, described as its strictest sandbox configuration.
4. Potential Access to Local Services
The researchers also identified paths from the compromised context toward Unix sockets.
One example discussed was the Docker daemon socket.
A Docker daemon socket can provide substantial privileges depending on the host configuration.
This should be distinguished from the demonstrated proof of concept. The research established sandbox escape and host command execution; the Docker socket represented an additional potential attack surface identified during the investigation.
5. Overpatch: Breaking the Workspace Boundary
The second vulnerability, Overpatch, affected Codex’s apply_patch functionality.
In workspace-write mode, Codex is intended to restrict file modifications to the designated project workspace.
Researchers found that the patch mechanism could be manipulated using attacker-controlled patch paths.
Their proof of concept used /tmp to influence the permitted path and then leveraged a symbolic link to modify .zshrc.
Because .zshrc is a shell initialization file, modifying it can cause commands to execute when a new Zsh session is started.
This demonstrated that the intended workspace restriction could be bypassed under the demonstrated conditions.
6. How the Two Vulnerabilities Differ
Although both vulnerabilities involved escaping intended restrictions, their technical mechanisms were different.
Heapjack
- Targeted
node_repl - Exploited shared process memory
- Recovered an authentication token
- Used the token to communicate with the privileged parent process
- Demonstrated host command execution
Overpatch
- Targeted
apply_patch - Manipulated patch paths
- Affected workspace permission enforcement
- Used a symbolic link
- Demonstrated modification of
.zshrc
7. Why the Sandbox Boundary Was Important
The central issue in the research was the relationship between restricted code and trusted functionality.
In Heapjack, the untrusted execution context was able to recover authentication material associated with a trusted context because both operated within the same Node.js process.
In Overpatch, the file-modification mechanism could be manipulated so that an operation intended for the workspace affected another location.
The two findings therefore demonstrate different ways in which controls intended to isolate an AI coding environment can become attack surfaces themselves.
8. AI Coding Agents as the Execution Environment
The vulnerabilities occurred in the Codex execution architecture, rather than representing a compromise of the underlying AI model.
That distinction is important.
An AI coding agent can process repositories, source files, dependencies and project instructions while also having access to tools capable of modifying and executing code.
Consequently, weaknesses in the surrounding execution environment can potentially turn untrusted code or content into a path toward higher privileges.
The Codex research provides a concrete example of that risk.
9. Disclosure and Fixes
The researchers reported the vulnerabilities to OpenAI on August 12, 2026.
They stated that OpenAI addressed the issues within eight days.
The reported fixed versions included:
- Codex Desktop 26.818.21641
- Codex CLI 0.149.0
Later versions also contain the fixes.
Users running affected versions should update to versions containing the security fixes.
10. What Was Demonstrated
The disclosed research demonstrated that:
- Code running inside the Codex sandbox could recover a trusted authentication token under the Heapjack attack.
- The recovered token could be used to communicate with a privileged parent process.
- Host command execution could subsequently be demonstrated.
- The Heapjack technique worked in the reported read-only configuration.
- Codex’s patch mechanism could be manipulated to affect filesystem boundaries under the Overpatch attack.
- A symbolic link could be used in the demonstrated Overpatch scenario to modify
.zshrc. - Unix sockets represented additional local interfaces that could potentially be relevant after escaping the sandbox.
These findings describe the researchers’ demonstrated techniques and identified attack surfaces. They do not establish that every Codex installation was compromised or that every host exposed the same attack paths.
11. Final Takeaway
The Codex research highlights a specific challenge for AI coding environments: the security boundary does not end at the sandbox configuration.
The surrounding mechanisms that handle authentication, privileged processes, filesystem permissions and host interfaces must also remain isolated from untrusted execution.
Heapjack demonstrated this through token recovery and host-process interaction.
Overpatch demonstrated it through manipulation of filesystem restrictions.
Together, the findings show how seemingly separate implementation weaknesses can undermine the boundary between an AI coding agent and the underlying host.
The AI agent may operate inside a sandbox.
The security architecture determines whether that sandbox actually holds.
