OpenAI’s Codex desktop app and CLI were found to contain two sandbox‑escape bugs—Heapjack and Overpatch—that let untrusted code run on a developer’s machine without any approval prompt. The flaws were disclosed on August 12, patched within eight days, and highlight that any enforcement that lives inside the coding agent can be subverted, a fact that directly impacts AI engineers, platform teams, and security practitioners who rely on these tools.
Coding Agent Sandbox Failures
Heapjack resides in Codex Desktop, which launches a helper process (node_repl) that hosts two JavaScript contexts sharing a single V8 heap. The trusted context stores a secret token, while the untrusted context executes user‑supplied code. By calling v8.getHeapSnapshot(), the untrusted code could locate the token in memory, then use a shared pipe to issue commands that the parent process executed outside the sandbox. The exploit required only a read‑only repository view and a standard question to the agent.
Overpatch is an issue in the open‑source Codex CLI’s apply_patch tool. The tool determines its own file‑system permissions based on the directories of the files it patches. By including a path entry for /tmp, the tool inadvertently granted itself write access to the root of the disk. A crafted patch wrote a malicious line into .zshrc via a symlink, persisting code execution each time a shell started. This also occurred without any user prompt.
Why This Matters to Practitioners
Both bugs demonstrate that a coding agent can leverage the same privileges a developer’s workstation already possesses—SSH keys, cloud credentials, and pipeline access. When sandbox enforcement is internal, the agent can bypass it and act on the host directly. For teams that integrate AI coding assistants into CI/CD pipelines or local development environments, this expands the attack surface from the agent itself to any resource the developer can reach.
Operational and Security Implications
- Version hygiene is critical. The fixes are available in Codex Desktop build
26.818.21641and Codex CLI0.149.0. Because the desktop and CLI have independent versioning, updating one does not guarantee the other is patched. - Treat all external repositories as untrusted input. Even read‑only mode did not stop Heapjack, so relying on repository permissions alone is insufficient.
- Approval prompts are not a security boundary. The exploits operated without any visible prompt, indicating that UI‑based confirmations cannot be the sole defense.
- Enforcement must be external to the agent. The root cause—“the thing doing the enforcement was sitting inside the thing being enforced”—suggests that control‑plane isolation (e.g., running the agent inside a VM or container while keeping credentials on the host) is a more reliable mitigation.
- Consistent patch management across environments. A patched install on a developer laptop does not protect CI runners, shared workstations, or other machines where the agent may be installed.
Related CloudNinjas coverage: AI engineering.
What This Means For Practitioners
Immediately verify that every machine running Codex Desktop or the CLI is on the patched versions. Audit your development environments to ensure that no secret tokens or privileged files are shared between trusted and untrusted execution contexts. Consider isolating the entire agent in a dedicated VM or container, keeping real credentials on the host and routing agent traffic through a proxy that the agent cannot modify. When evaluating new AI coding tools, ask vendors where the enforcement boundary resides and how quickly they respond to reported vulnerabilities. By moving the enforcement layer out of the agent’s reach, you reduce the risk of future sandbox escapes and protect the broader development and production ecosystem.
