OpenAI Codex Heapjack Overpatch research disclosed two separate sandbox escapes that OpenAI says were fixed in August 2026. The vulnerabilities affected different trust boundaries and should not be treated as one universal Codex flaw. Overpatch affected the Codex CLI workspace-write boundary, while Heapjack involved a privileged helper installed by Codex Desktop and was demonstrated from a read-only session under the researchers’ documented configuration.
The practical question for Codex users is therefore not simply whether they use Codex. They should inventory the CLI and Desktop separately and compare each installed build with the disclosed fixed floor. Accomplish AI identifies Codex CLI 0.149.0 or later as fixed for Overpatch and Codex Desktop build 26.818.21641 or later as fixed for Heapjack.
Heapjack and Overpatch are different sandbox failures
| Issue | Affected area | Boundary demonstrated | Disclosed fixed floor |
|---|---|---|---|
| Overpatch | Codex CLI | Writes outside the intended workspace boundary under the demonstrated pre-fix condition | CLI 0.149.0 or later |
| Heapjack | Codex Desktop-installed helper | Privileged helper actions outside the intended sandbox boundary under the documented configuration | Desktop 26.818.21641 or later |
The distinction matters because the two issues do not share the same prerequisite. A developer using an older CLI should not automatically assume the Heapjack path applies, while a Desktop installation can introduce configuration relevant to later Codex use.
What Overpatch changed in the CLI trust boundary
Overpatch concerned the behavior of the Codex CLI while operating under workspace-write. The intended security model allowed writes within the approved workspace while restricting writes outside it. The researchers demonstrated that the affected patch path could cross that intended filesystem boundary.
TPS is not reproducing the exploitation procedure. For defensive purposes, the important facts are the affected trust boundary and the disclosed fixed version: users operating an older Codex CLI should move to version 0.149.0 or later, or follow newer OpenAI guidance if it supersedes that floor.
What Heapjack changed in read-only mode
Heapjack involved a different architecture. The researchers describe a JavaScript helper installed by Codex Desktop that communicated with a more privileged native parent process. Under the documented pre-fix configuration, untrusted sandboxed JavaScript could cross the intended trust separation and cause actions outside the restricted sandbox.
The demonstration is significant because it originated from read-only mode, but that does not mean every read-only Codex session or every CLI-only installation had the same exposure. The disclosed path depended on the relevant Desktop-installed helper and global Codex configuration.
Was every Codex CLI user exposed to Heapjack?
No universal exposure claim is supported by the reviewed evidence. The researchers’ Heapjack path involved a helper placed into global Codex configuration by the Desktop application, which could then be available to subsequent Codex use. That is materially different from saying every standalone CLI installation contained the same vulnerable path.
Administrators should therefore inventory whether Codex Desktop had been installed in addition to checking the current CLI version.
OpenAI says both issues were fixed in August
Accomplish AI says it reported both vulnerabilities to OpenAI on August 12 and that both were fixed within eight days. OpenAI later told BleepingComputer that both issues had been addressed in August and said it had strengthened controls around agent write locations and expanded sandbox testing.
TPS did not recover a dedicated OpenAI security advisory that names Heapjack and Overpatch and maps each issue to a formal CVE. The absence of such an advisory does not negate the confirmed patch state, but it means CVE identifiers and a complete official affected-version matrix should not be invented.
Is malicious exploitation confirmed?
TPS did not establish authoritative evidence that Heapjack or Overpatch was exploited maliciously in the wild. The public material reviewed for this article documents researcher demonstrations and subsequent fixes, not an active compromise campaign.
That distinction should remain explicit. A demonstrated sandbox escape can justify prompt patch verification without being described as an actively exploited zero-day event.
What Codex users should check now
If the CLI is older than 0.149.0, update to 0.149.0 or a newer supported release.
If Desktop is installed, verify that it is build 26.818.21641 or later.
Heapjack’s disclosed path involved a Desktop-installed helper in global Codex configuration, so CLI and Desktop exposure should not be evaluated as completely independent when both have been used.
Sandbox restrictions reduce risk but should not be treated as proof that repository-controlled content can never reach a host boundary.
The disclosure does not justify disabling sandbox or approval controls. Update the product while retaining the strongest practical isolation settings.
If OpenAI later publishes a dedicated advisory or newer fixed-version requirement, use that controlling guidance instead of relying indefinitely on the disclosure-era floors.
What remains unresolved
TPS did not establish formal CVE assignments, a complete lower affected-version range, identical Heapjack behavior across every operating system or evidence of malicious exploitation. The researchers’ host-action demonstration included platform-specific behavior, so the exact proof-of-concept impact should not be generalised across Windows, Linux and macOS without additional evidence.
This same URL should be updated if OpenAI publishes a dedicated advisory, CVEs are assigned, the affected build or platform scope changes, additional sandbox hardening is documented or credible evidence of real-world exploitation emerges.