The findings, detailed by Accomplish AI researcher Oren Yomtov, target OpenAI's Codex coding agent, available as a command-line tool and a desktop app. Codex runs model actions inside a sandbox to prevent untrusted code from affecting the wider system, but both exploits defeat that boundary from within.

Heapjack targets a component called node_repl, which Codex Desktop writes into the global config file at install time with no opt-in. The component runs a single Node.js process holding two JavaScript execution contexts: one trusted (OpenAI's code) and one untrusted (agent code). Because both share one memory heap, a random token meant to authenticate the trusted context is accessible to the untrusted side. The exploit snapshots the heap to find the token, then uses it to write requests onto the same pipe the trusted context uses to communicate with an unsandboxed parent process. The parent executes the commands, enabling actions such as launching external applications, reaching Unix sockets (including a Docker daemon socket), or editing global configuration — all while Codex is in read-only mode.

The second flaw, Overpatch, exists in the open-source Codex CLI. In workspace-write mode the agent is restricted to the project folder, but the researchers found that Codex's apply_patch tool could write outside that boundary. By naming '/tmp' in a patch, the tool grants write access to the root directory, allowing arbitrary file modification.

OpenAI addressed both issues within eight days. The researchers note that Heapjack is particularly concerning because it can be triggered simply by opening a malicious repository and asking Codex a question about the code; the repository author gains unsandboxed command execution on the developer's machine.