On September 15, 2026, Accomplish disclosed two Codex sandbox escapes: Overpatch in the CLI's file-edit path and Heapjack in the desktop-installed JavaScript helper. The researcher says both were reported to OpenAI on August 12 and fixed within eight days. This is a new disclosure of already-patched flaws, so the immediate job is to find installations that missed the fixes.
Check the CLI and desktop app separately. Accomplish identifies CLI 0.149.0 for Overpatch and desktop build 26.818.21641 for Heapjack as the minimum fixed versions. OpenAI's 0.149.0 release, published August 20, includes the patch-permission fix. Deploy a current approved release; those historical minimums are useful for identifying missed updates.
General Analysis has not reproduced these exploits. Our recommendations combine the disclosure with public documentation and extend the rollout baseline in securing coding agents.
What failed, and what the patch proves#
Overpatch derived extra write authority from paths supplied in a patch. An already-writable directory could widen access to its parent. OpenAI's fix, merged August 20, filters out already-writable targets before deriving additional parent permissions. Its regression coverage includes workspace-directory targets and a symlink leading outside the workspace. The code change and test cases give administrators a specific repair to track in their approved build.
Heapjack crossed a different boundary. According to Accomplish's report, agent JavaScript could recover a trusted token from shared process memory and use it to request privileged actions from an unsandboxed helper, even in read-only mode. Node's own vm documentation warns that the module is not a security mechanism. Separate JavaScript contexts should therefore not be treated as separate trust domains.
The public CLI release establishes the Overpatch repair. The desktop build threshold comes from the researcher; we did not independently inspect the closed desktop helper's complete fix. OpenAI also merged Node REPL token environment hardening on August 18, but stripping an environment variable does not, by itself, establish how the shared-memory flaw was repaired.
See how your AI systems hold up under real attacks
General Analysis maps AI applications and agents, red teams prompts, retrieval, tools, MCP servers, browser actions, permissions, and business workflows, then turns findings into evidence your team can reproduce and retest.
Inventory the executable and the helper#
A terminal, an IDE, and a scheduled task can start different installations. Record what each launcher actually runs before treating one successful update as fleet-wide coverage.
| Surface to inventory | Record before closing the upgrade task |
|---|---|
| Terminal CLI | Resolved executable path, reported version, installation source, and replacement version |
| Desktop app | Installed build, update receipt, and build reported after relaunch |
| Desktop-installed JavaScript helper | Whether the configured helper is present, its executable path, and which updated app supplies it |
| IDE, background task, or automation launcher | Executable and configuration used by that launcher; fresh task start after the upgrade |
The helper row matters even for terminal users. Accomplish reports that the desktop installation added node_repl through global MCP configuration, making it reachable from the CLI too. A CLI upgrade alone is therefore insufficient evidence that the desktop-supplied component was replaced.
OpenAI's MCP documentation documents codex mcp list and the global and project configuration locations. Use the actual task account and launcher environment for this inventory. Keep the output in the restricted incident record: configuration details can identify internal services.
Code source: illustrative macOS/Linux inventory commands. Run in your normal administrator terminal, outside an agent task. These list executable locations, versions, and configured servers; they do not exercise either vulnerability.
type -a codex
command -v codex
codex --version
codex mcp list
Repeat the version check using the exact executable configured by each service or IDE. Record the desktop build through the app's version display or your device-management inventory. These commands alone cannot prove which desktop helper an already-running process has loaded.
After deploying the approved updates, stop and relaunch the affected clients and their managed background work through your normal operations procedure. Verify a fresh task uses the expected executable, helper, and policy. Avoid closing the ticket solely because the installer succeeded.
Retain the boundary after updating#
OpenAI documents sandboxing and approvals as separate controls. Keep the workspace bounded, retain approval for exceptional access, and review explicitly added writable directories. Switching to full access to work around an upgrade problem removes the boundary you are trying to restore.
Managed policy also needs an activation check. OpenAI's local security guidance says a background policy refresh does not establish that an existing task loaded it; macOS MDM requirements apply at the next client launch. Record effective settings after restarting the relevant client.
For sensitive work, review the entire process environment: agent, file tools, helpers, and their credentials. An outer VM can contain a helper escape only if the helper also runs inside it. Host-mounted secrets, privileged sockets, or a broker that accepts overly broad requests can defeat the intended separation. Treat this as an architecture review, not a claim that installing a VM resolves every agent risk. Our MCP server threat model covers the connected-tool side of that review.
Separate patch completion from exposure review#
The disclosure establishes a reason to investigate; it does not establish compromise on a particular device. Preserve available evidence before routine cleanup overwrites it. Focus the review on devices that ran affected components and handled untrusted material during their actual installed-version window.
For a hypothetical developer workstation, use two work items:
- The platform owner replaces the affected CLI and app, restarts the relevant processes, and records the versions and effective policy of fresh tasks.
- The incident responder reviews earlier task activity, file changes outside approved workspaces, unexpected application launches, and connected-system activity. They document unavailable telemetry as unknown coverage.
Correlate agent records with endpoint file and process events and downstream service logs. The reported helper path could launch an application outside the ordinary Codex process tree, so a search limited to direct Codex children is too narrow. An out-of-workspace file change or application launch is an investigative lead, not a unique indicator of these flaws.
If evidence suggests credential access or persistence, follow your established containment, credential-revocation, and recovery procedure. Do not rotate every credential solely because a vulnerable version existed, or declare the device clean solely because no alert fired.
The upgrade ticket needs evidence that each launch path uses an approved fixed release and fresh tasks load the intended controls. The exposure review needs its own conclusion, including the period investigated and any gaps in the records.
