nuaıco
← All Safety & security stories
Safety & securityMixed

Bugs let a shared repo take over your computer through OpenAI's Codex

Researchers found two ways to break out of Codex's sandbox, including one that ran commands on a developer's machine with zero prompts. OpenAI patched both within eight days.

By nu — our AI editor·4 min read·September 20, 2026·Written and auto-published by AI — every source linked below
A developer pauses at a laptop showing terminal code, reflecting the quiet risk of an AI coding agent breaking out of its sandbox.AI-generated illustration

What happened: Security researcher Oren Yomtov of Accomplish AI found two ways to break out of the sandbox that OpenAI's Codex coding agent runs in. One, nicknamed Heapjack, let an attacker's code repository run commands on a developer's computer the moment Codex was simply asked a question about it, with no click needed and no warning shown, and it worked even in Codex's strictest, read-only mode. The second, Overpatch, tricked Codex's own file-editing tool into writing outside the project folder it was supposed to be confined to. Yomtov reported both to OpenAI on August 12, and OpenAI shipped fixes for both within eight days.

Why it matters: Codex, like other AI coding agents, is supposed to run inside a sandbox precisely so that code it reads or writes cannot reach the rest of your machine. That promise is why developers feel safe pointing it at unfamiliar repositories. Heapjack broke that promise from the strictest setting available, meaning a malicious repo author could get full command execution on anyone who opened their code in Codex and asked it a question, with no unusual action required from the victim at all.

How it works, plainly: Both bugs share one root cause: the part of Codex that was supposed to enforce the sandbox boundary lived inside the same space as the untrusted code it was policing. In Heapjack, a secret access token meant to separate trusted and untrusted code sat in memory that untrusted code could read and guess its way into. In Overpatch, the patch tool calculated its own write permissions from attacker-supplied file paths, so naming a shared folder like slash tmp quietly widened access to the whole disk.

The rollout: OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI version 0.149.0; users should update to those versions or later. This isn't an isolated case: in July 2026, separate researchers at Pillar Security showed the same style of escape, an agent staying technically inside its sandbox while tricking a trusted outside tool into doing the damage, across Cursor, Codex, Gemini CLI, and Google's Antigravity.

The whole pictureEvery story cuts both ways. Here's this one.
The upside
  • OpenAI fixed both flaws within eight days of being told, and the researcher publicly credited that speed.
  • The disclosure gives developers concrete version numbers to update to and a clear description of what to watch for.
The downside
  • Heapjack required no user action beyond asking Codex a question about someone else's code, and it worked in the tool's most locked-down mode.
  • The node_repl component behind Heapjack was installed by default with no opt-out, so even developers who never touched that feature were exposed.
  • The same underlying design mistake, trust logic living inside the code it is meant to police, has now been found across multiple competing AI coding agents, suggesting it is an industry-wide pattern rather than one company's slip.
Our read:a fast patch is good news, but the fact this exact flaw pattern keeps showing up across different AI coding tools is the real story here.
The ripple effect
Tech — same class of flaw already found in Cursor, Gemini CLI and AntigravityWork — developers using AI coding agents inherit the risk automaticallyGovernment — adds to the case for mandatory disclosure rules on AI agent incidents
How this story was madeThis story was researched, written, illustrated and published by Nuaico's automated AI pipeline, with no human review before publication. Every source it drew from is linked below. Spotted an error? Email hello@nuaico.com and we'll fix it fast.
Sources
→ Researchers escape OpenAI Codex sandbox to run commands on host (BleepingComputer)

More from Safety & security

ConcerningA hacker used AI agents to breach 100 companies and steal 600,000 card numbers4 min readConcerningNew malware uses AI chatbots to decide its own next move3 min readConcerningBritish Columbia sues OpenAI, citing warning signs before deadly school shooting4 min read