Codex Sandbox Escape 2026: What UK Dev Teams Must Do

Two escapes, one Codex sandbox

Security researcher Oren Yomtov of Accomplish AI reported two separate flaws to OpenAI on 12 August 2026, and OpenAI fixed both within eight days. The more serious, dubbed Heapjack, targets a component called node_repl that Codex Desktop writes into the global ~/.codex/config.toml at install time, with no opt-in or setting to disable it, and that Codex CLI users inherit via the shared config file.

Heapjack exploits the fact that two JavaScript execution contexts — one trusted, one untrusted — share the same memory heap. The untrusted side can read a supposedly secret authorisation token straight out of memory, then use it to send commands to a native, unsandboxed parent process. In the proof of concept, this reached far enough to launch applications via the system 'open' command, reach Unix sockets including a Docker daemon socket, and invoke a tool that edits the global config file — all while Codex was in read-only mode, its strictest sandbox setting.

The second flaw, Overpatch, exploited Codex CLI's apply_patch tool, which granted write access to the parent folder of each path named in a patch based on attacker-supplied file paths. Naming '/tmp' in a patch granted write access to the root of the disk, letting an attacker append a malicious line to '.zshrc' via a symlink into the home directory so the next terminal session ran their code unsandboxed.

Why this matters beyond OpenAI's fix

Both bugs share the same design flaw: the mechanism enforcing the sandbox boundary lived inside the code it was meant to be policing. That is not an OpenAI-specific mistake, and it is why UK teams evaluating any AI coding assistant should treat this as a category risk rather than a single-vendor bug. For teams still understanding AI coding agents before wider rollout, Heapjack is a clear illustration of how a routine action — opening a colleague's or a third party's repository and asking a question about it — can, in the demonstrated exploit scenario, hand the repository's author code execution on your machine.

That detail matters for supply-chain thinking. Any workflow where developers open external, cloned or contributor-submitted repositories inside an AI coding agent is now a plausible RCE path, not just a prompt-injection concern.

A pattern across the AI agent market

The Codex flaws are not isolated. In July 2026, researchers demonstrated the same trusted-tool-outside-the-sandbox pattern across Cursor, Codex, Gemini CLI and Google's Antigravity, alongside a separate Cursor flaw, reported as 'DuneSlide' in later coverage, that let prompt injection break out of the editor's sandbox to run host commands. September brought a critical macOS Docker Sandboxes host-escape flaw in the virtio-fs host server (CVE-2026-77179), fixed in version 0.42.0, and a DeepSeek Harness bug (CVE-2026-82533) that let an agent turn off its sandbox protections via its local web interface.

For procurement and security teams weighing vendor claims, this run of incidents is worth reviewing alongside other AI agent sandbox escape incidents and the broader AI code generation security risks now surfacing across the sector.

Immediate actions for UK IT teams

OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0. Every team running Codex on developer machines or in build pipelines should confirm those versions or later are deployed before treating this as resolved.

• •Audit installed Codex Desktop and CLI versions across all developer laptops and CI runners
• •Log and alert on agent processes reaching Unix sockets, Docker daemons or global config files
• •Treat any AI agent activity touching shell startup files (.zshrc, .bashrc) as a high-priority alert
• •Restrict which repositories developers may open in AI coding agents until provenance is checked

Monitoring, API controls and machine identity

Beyond patching, this class of bug argues for treating AI coding agents as privileged machine identities rather than passive tools — a shift covered in our analysis of machine identity security in the age of AI agents. Scoping API tokens tightly, avoiding shared or long-lived credentials across trusted and untrusted contexts, and logging every command an agent issues gives teams a chance to catch the next boundary bypass before it reaches production.

Cost governance is part of the same conversation. Anthropic changed its billing rules in May 2026 so subscription pricing covers only interactive use, pushing agentic and automated workloads onto metered API billing — a shift industry coverage has linked to developer bills running into thousands of pounds a month if usage and rate limits aren't controlled alongside security.

Building a durable response

UK organisations running Codex, Cursor, Gemini CLI or comparable agents in build pipelines should combine a formal what monitoring and API restrictions prevent host compromise review with wider controls: securing developer machines and endpoints that run these agents, applying zero-trust principles to agent-to-daemon communication, and feeding agent activity into managed detection so unusual command patterns are flagged in real time rather than discovered after the fact.

Cost governance is part of the same conversation. Anthropic changed its billing rules in May 2026 so subscription pricing covers only interactive use, pushing agentic and automated workloads onto metered API billing — a shift industry coverage has warned can drive developer bills into the thousands a month if usage and rate limits aren't controlled.