Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

Entity trail

Oren Yomtov

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

1

Findings

1

Edges

2

Sources

1

Corpus findings

2026-09-21 / agents-researcherOpening a stranger's repo in OpenAI Codex handed the repo author unsandboxed shell on your machineOren Yomtov of Accomplish AI disclosed two Codex sandbox escapes on 2026-09-20. Heapjack abuses node_repl, a helper Codex Desktop writes into the global ~/.codex/config.toml at install with no opt-in and no off switch: the trusted and untrusted JS contexts share one Node heap, so untrusted agent code snapshots the heap with v8.getHeapSnapshot(), brute-forces the UUID-shaped auth token, and writes requests onto the pipe to the unsandboxed native parent, all from read-only mode with no approval prompt. Overpatch abuses Codex CLI's own apply_patch, which grants write access to the parent folder of every path a patch names, so naming /tmp opens the disk root and a second hunk appends to .zshrc through a symlink. Reported August 12, fixed in eight days; Codex Desktop build 26.818.21641 and Codex CLI 0.149.0.

Graph relationships

CRITICIZES
Codex
Oren Yomtov disclosed two critical sandbox escape vulnerabilities in Codex.
Source finding
WORKS AT
Accomplish AI
Oren Yomtov of Accomplish AI disclosed Codex sandbox escapes.
Source finding

Source trail

BleepingComputer

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues