AI Risk Wire

Cases › security breach › LR-2026-0724

Researchers break out of OpenAI Codex sandbox twice

Preliminary Why: Publisher not yet named · subject to change

Status: fix reported

Severity minor
Reported 21 Sep 2026
Developer and model OpenAI
Could do files, software tools, commands

No source states: loss or records, agent tool, deployer, industry.

Severity minor: test: contained to one evaluation with no third party touched; no exploitation indicated in the sources

Security researchers found two sandbox escape flaws in OpenAI’s Codex coding agent, named Heapjack and Overpatch. Heapjack affected a JavaScript component installed with Codex Desktop; the researchers said a malicious repository could exploit it to run commands on the computer, and their demonstration worked even in strict read-only mode with no approval request shown. Overpatch affected the open-source Codex command-line tool, where the patching mechanism could be manipulated into gaining permission to write outside the project workspace. The researchers reported both issues to OpenAI, which fixed them within eight days, and the disclosure gave no indication either flaw had been exploited in the wild.

What happened

1 · What it was doingThe Codex coding agent can interact with files, software tools and commands on the user's computer, within a sandbox that limits what those actions can reach.
2 · What went wrongTwo ways to escape the Codex sandbox were found; one could run commands on a developer's computer without an approval prompt.
3 · How it was caughtSecurity researcher Oren Yomtov of Accomplish AI discovered the two vulnerabilities, named Heapjack and Overpatch.

What was done

Both vulnerabilities have been patched.
Fix reported

“Both vulnerabilities patched by OpenAI”

Vulnerability scanning of AI components

Same developer, same risk, after the fix: LR-2026-0788 · LR-2026-0792 · LR-2026-0069

Risks

Agent escapes its sandbox
Primary19 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Sandboxed code execution · Network egress control · Fail-closed defaults

Application

Segmentation of agent components · Vulnerability scanning of AI components · Live behaviour monitoring · Adversarial testing before deployment

Similar incidents

Red-team campaign finds 11 attacks defeating Codex sandbox and Auto-review monitor2026-10-30
OpenAI Codex authentication tokens stolen via malicious npm package codexui-android2026-06-01
ChatGPT shared-link Preview sandbox escape via MathLive postMessage listener2026-10-31
EMBRACE: Codex embedded browser reads files outside the project via malicious HTML2026-10-30

All cases of this kind ›

Evidence

No source states: what it reached or did, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what set it off.

Show the full account: 4 items from the primary sources

What happened, in order

  1. August 12 Researchers reported the issues to OpenAI.

Not dated in the sources:

  • OpenAI fixed both vulnerabilities within eight days of the report.
  • Heapjack was fixed in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0.
  • Disclosure stated no indication that the vulnerabilities were exploited in the wild.
Show every field, with its source and grade

The AI system

Developer
OpenAI
C one secondary source states it
Tools it was given
files, software tools, commands
C one secondary source states it
Safeguards in place
sandbox
C one secondary source states it

What happened

Earliest source we hold
2026-09-21
D inferred by us from the described behaviour, reason shown
Who caught it
an independent researcher or journalist
C one secondary source states it
Cause
a safeguard that was in place did not hold
C one secondary source states it
Cause in detail
Sandbox controls relied on information that could be influenced from inside the restricted environment
C one secondary source states it
Who was responsible
the model provider
C one secondary source states it
What was done
Both vulnerabilities patched by OpenAI
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
primary risk
RK05
D inferred by us from the described behaviour, reason shown

Impact

Severity
minor
D inferred by us from the described behaviour, reason shown
Why this severity
test: contained to one evaluation with no third party touched; no exploitation indicated in the sources
D inferred by us from the described behaviour, reason shown

Notes on gaps

Remediation adds J1 (known flaws patched) as the closest control for the fixes.

LR-2026-0724 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON