// hackerlogs
login+ register
Agentic AILLM AppSecThreat BriefHigh

Read-Only Codex Still Ran the Repo Owner's Code.

Accomplish found two Codex sandbox escapes. Heapjack ran host commands from read-only. Overpatch wrote outside the workspace. OpenAI fixed both in eight days.

Ajain Vivek · Editor, hackerlogs4 min readPractitioner

The short answer

Oren Yomtov of Accomplish reported two Codex sandbox escapes on 12 August. Heapjack turned a read-only look at someone else's repository into unsandboxed host commands, with no prompt. Overpatch let the CLI patch tool write outside the workspace. OpenAI fixed both in eight days. Desktop 26.818.21641. CLI 0.149.0. The changelog no longer shows that line.

Key takeaways

  • Heapjack is a Desktop helper. Open a cloned repo in read-only, ask a question, and the repo owner gets host commands. No approval. Nothing on screen.
  • Overpatch is the open-source CLI. The patch tool worked out its own write grant from paths in the patch. A refused shell write to home was not the control.
  • Both bugs have the same shape. The thing doing the enforcement sat inside the thing being enforced. A shared heap. A tool that granted its own parents.
  • Reported 12 August. Fixed inside eight days. Accomplish published 15 September. BleepingComputer and DevOps.com carried it this weekend. OpenAI confirmed the August fix on 21 September.
  • Check Desktop and CLI separately. A patched laptop is not a patched CI runner. Read-only is not a deny if the token lives in the same process.

US X Trends on 22 September were football again. Hacker News spent the day on a math package. The operator board that Google still surfaces is Accomplish's Codex write-up: two ways out of the sandbox, one of them from read-only.

High Open a cloned repo, ask a question, host commands. High because read-only was not a deny, not because a customer dump landed.

Codex Heapjack and Overpatch: a read-only repo look that still reaches the host, an eight-day report-to-fix clock, and the operator work of updating Desktop and CLI separately then putting the deny outside the agent.

What Accomplish actually published.#

Oren Yomtov reported both bugs to OpenAI on 12 August. Both were fixed inside eight days. The public write-up landed 15 September. BleepingComputer carried it 20 September. OpenAI's comment arrived the next morning. DevOps.com put the design lesson on 21 September.

Heapjack sits in a Desktop helper that lands in the shared Codex config at install. There is no opt-in. Plain CLI users inherit it. Trusted and untrusted JavaScript share one process and one heap. The secret that told the parent which side to believe lived in that heap. From read-only, a look at someone else's repository became unsandboxed host commands. No prompt. Nothing on screen.

Overpatch sits in the open-source CLI. In workspace-write, a shell write to home is refused. The patch tool still worked out a wider grant from paths named in the patch. Accomplish's line: one extra change hands the tool write access it should not have, with no approval.

We are not reprinting the memory scan, the pipe format, or the patch that widens the grant. The operator fact is enough. The deny lived inside the agent.

OpenAI thanked the researchers and said it addressed both issues in August, then tightened where agents can write. Accomplish names Desktop 26.818.21641 and CLI 0.149.0. The visible CLI changelog now begins at 0.154.0. Do not close the ticket because the 0.149.0 note left the page.

Why the guardrail was inside the agent.#

Yomtov's sentence is the ticket: the thing doing the enforcement was sitting inside the thing being enforced. The patch tool derived its own parents. The trust token sat next to the code it was supposed to restrain.

That shape is not new. Pillar Security showed a related class in July across Cursor, Codex, Gemini CLI, and Antigravity: the agent stays in the box and writes a file a trusted tool outside the box later runs. Cymulate had a configuration escape in April. Plugin4Shell was a pin that did not check the checkout. Different mechanics. Same lesson. A control the agent can see is a control the agent can spend.

  1. Yomtov reports Heapjack and Overpatch to OpenAI.
  2. Accomplish says both are fixed inside eight days. CLI floor 0.149.0. Desktop floor 26.818.21641.
  3. Accomplish publishes. The design line is enforcement outside the guest.
  4. BleepingComputer carries the host-command story.
  5. OpenAI confirms the August fix. DevOps.com writes the control-plane lesson. The public CLI changelog no longer starts at 0.149.0.
  6. US X Trends are football. Google still surfaces the Codex escapes. Hacker News is on mathmain.

What this is not.#

It is not Plugin4Shell. That is a marketplace pin. This is a sandbox that believed itself.

It is not the Hacktron forum token. That path was identity. This path is a cloned repository.

It is also not proof that Bubblewrap failed. The public write-up puts the hole in the helper and the patch tool, the layer that talks to the box.

What to do.#

If you run Codex on a laptop or in CI:

  1. Read Accomplish as the scope. Two bugs. 12 August report. Eight-day fix. 15 September public. No wild-use headline.
  2. Update Desktop past 26.818.21641 and CLI past 0.149.0. Check the binary, not the changelog page. Check runners, not just laptops.
  3. Treat a repository you did not write as untrusted input, including in read-only. Heapjack did not need a write mode.
  4. Hunt August installs that missed the floor. Look for unexpected host launches and unexpected writes outside the workspace after a Codex session.
  5. Put the next deny outside the agent process. A VM or a job that cannot grant itself parents. A shared heap is not a trust boundary.

Hacker News will keep arguing about vibe-coded sandboxes. The ticket is a read-only look that still reached the host because the guardrail lived in the same memory as the agent.

Frequently asked

Is this Plugin4Shell or the forum SSO chain?

No. Plugin4Shell is a git pin that did not verify the checkout. The Hacktron write-up is a forum upload plus an OpenAI SSO token. Heapjack and Overpatch are Codex sandbox escapes. Same product family, different tickets. File them separately.

Did anyone use this in the wild?

No public sign. Accomplish and BleepingComputer both treat it as coordinated research. The fileable fact is that read-only was not a host deny on unpatched Desktop, and workspace-write was not a disk deny on unpatched CLI.

Which versions are fixed?

Accomplish names Codex Desktop 26.818.21641 and Codex CLI 0.149.0 as the floor. OpenAI told BleepingComputer it addressed both in August and has since tightened where agents can write. The public CLI changelog now starts at 0.154.0, so do not hunt the 0.149.0 note on the page. Check the binary.

What should a team change tonight?

Inventory every Codex Desktop and CLI install, including CI. Update past those floors. Treat a repo you did not write as untrusted input even in read-only. Do not accept an approval prompt as the control. Put the deny outside the agent process.

Sources

Related