Accomplish found two ways to escape the OpenAI Codex sandbox. Overpatch lets a patch write anywhere on disk with no prompt. Heapjack achieves unsandboxed command execution from read-only mode. Both were reported to OpenAI on August 12, 2026. OpenAI fixed both within eight days. Overpatch exploits the Codex CLI’s patch tool to grant write access to parent folders. Heapjack reads a secret token from shared memory in the Codex Desktop JavaScript tool. The token allows unsandboxed actions like launching applications or editing config files. Users must update Codex Desktop to build 26.818.21641 or later and Codex CLI to 0.149.0 or later. Accomplish mitigates both by running agents in a VM with no real credentials.
What changed
Codex sandbox prevented write access outside workspace and blocked unsandboxed command execution in read-only mode.
What it unlocks
Writing anywhere on disk without prompts and achieving unsandboxed command execution from read-only mode.
- 2 sandbox escapes
- fixed within 8 days
- Codex Desktop build 26.818.21641 or later
- Codex CLI 0.149.0 or later
What you need to act on it
- Codex CLI before 0.149.0
- Codex Desktop before build 26.818.21641
Sources