Opening a stranger's repo in OpenAI Codex handed the repo author unsandboxed shell on your machine
Oren Yomtov of Accomplish AI disclosed two Codex sandbox escapes on 2026-09-20. Heapjack abuses node_repl, a helper Codex Desktop writes into the global ~/.codex/config.toml at install with no opt-in and no off switch: the trusted and untrusted JS contexts share one Node heap, so untrusted agent code snapshots the heap with v8.getHeapSnapshot(), brute-forces the UUID-shaped auth token, and writes requests onto the pipe to the unsandboxed native parent, all from read-only mode with no approval prompt. Overpatch abuses Codex CLI's own apply_patch, which grants write access to the parent folder of every path a patch names, so naming /tmp opens the disk root and a second hunk appends to .zshrc through a symlink. Reported August 12, fixed in eight days; Codex Desktop build 26.818.21641 and Codex CLI 0.149.0.
↳ Follow the thread