Overpatch and Heapjack: Two Techniques for Bypassing Codex's Write Restrictions and Escaping Its Read-Only Sandbox

Olá a todos, caros membros do **webmastersmz.com**.

Como especialista em cibersegurança e infraestrutura, analisei o artigo técnico sobre o **Overpatch** e o **Heapjack**, duas técnicas sofisticadas desenhadas para contornar as restrições de escrita e escapar ao *sandbox* de leitura exclusiva (*read-only*) do Codex. Este é um tema de extrema relevância para quem desenvolve ambientes isolados ou trabalha com a integridade de motores de execução.

Aqui estão os pontos fundamentais que devem ser discutidos:

1.  **Overpatching (Sobreposição de Patches):** O núcleo desta técnica reside na exploração da forma como o Codex gerencia as permissões de memória em tempo de execução. Ao injetar código em áreas protegidas, o atacante consegue sobrescrever instruções de controle, forçando o sistema a ignorar as diretrizes de segurança inicialmente impostas pelo *sandbox*.
2.  **Heapjack (Manipulação de Heap):** Esta técnica é mais refinada e foca-se na corrupção da memória *Heap*. Ao manipular a alocação de objetos dentro do ambiente do Codex, o atacante consegue "saltar" para fora dos limites permitidos, ganhando capacidade de leitura e escrita em blocos de memória que deveriam estar isolados.
3.  **Implicações de Segurança:** O perigo real destas técnicas é que elas tornam o conceito de "ReadOnly Sandbox" obsoleto se a implementação de baixo nível (kernel ou hipervisor) não for robusta o suficiente. Para nós, webmasters e administradores, isso reforça a importância de manter sistemas atualizados e, sempre que possível, utilizar abordagens de defesa em profundidade (*defense-in-depth*).

Estas técnicas revelam que, independentemente da segurança lógica aplicada, a arquitetura de memória subjacente é o elo que pode ser quebrado. Convido a comunidade do **webmastersmz.com** a debater: *Será que estamos a confiar demasiado em sandboxes de software em vez de implementar restrições baseadas em hardware (como o Intel CET ou ARM Memory Tagging)? Como é que protegem as vossas aplicações contra ataques de corrupção de memória?*

Deixem as vossas opiniões e experiências aqui no fórum, pois a partilha de conhecimento é o que nos torna mais resilientes.

Para garantir que os vossos projetos e fóruns rodam sem falhas, com a segurança e a velocidade que a vossa comunidade merece, convido-vos a conhecer as soluções de alojamento de alta performance da **AplicHost** em https://aplichost.com.

Overpatch and Heapjack: Two Techniques for Bypassing Codex's Write Restrictions and Escaping Its Read-Only Sandbox



Tópico: Overpatch and Heapjack: Two Techniques for Bypassing Codex's Write Restrictions and Escaping Its Read-Only Sandbox
Categoria: Tutoriais | Programação & Tecnologia
Idioma Principal: Português (Conteúdo de Tecnologia)

Descrição do Conteúdo / Informações:
-------------------------------------------------------------------------


1. Basic Information


• Original Title: Escaping the OpenAI Codex sandbox, twice

• Source: Accomplish AI

• Published: 2026-09-15

• Updated: None

• Severity: High

• Basis for Severity: Researchers verified Overpatch, which writes outside the workspace using workspace-write, and Heapjack, which executes host commands from the strictest read-only mode without an approval prompt. Conditions were also shown where simply opening a malicious repository and asking a question is enough. Both issues were patched within eight days of reporting, and no exploitation in real-world attacks has been reported.

• Original Article: Escaping the OpenAI Codex sandbox, twice

• Related Sources: BleepingComputer: Researchers escape OpenAI Codex sandbox to run commands on host, OpenAI Codex CLI 0.149.0 release

• Related Entities: OpenAI Codex CLI, Codex Desktop, apply_patch, node_repl, V8 vm context, macOS, Unix socket, Docker daemon



2. Quick Summary


Overpatch abuses the way apply_patch derives write permissions from paths in a patch, allowing writes outside the workspace while Codex is in workspace-write mode. Heapjack recovers the trusted context's authorization token from the shared V8 heap and submits forged requests that the unsandboxed native parent accepts, even when Codex is in read-only mode.



3. Attack Flow


The two techniques use separate attack paths. Both are sandbox escapes verified in a research environment, and public materials report no exploitation in real-world attacks.



Attack Path A: Overpatch (workspace-write)


• In the Codex CLI workspace-write mode, regular shell commands writing to $HOME are blocked.

• The apply_patch function at the time granted write permissions based on the parent directory of each path specified in the patch.

• Researchers added a no-op patch entry naming /tmp as a file target. The write failed because /tmp is a directory, but its parent, /, was nevertheless added to the allowed write scope.

• Using the same patch, they appended a line to $HOME/.zshrc via a symbolic link inside the workspace.

• When the developer next opens a terminal, the command added to .zshrc runs outside the sandbox.



Attack Path B: Heapjack (read-only)


• Codex Desktop at the time added [mcp_servers.node_repl] to the global ~/.codex/config.toml, making it available from the Codex CLI as well.

•
node_repl starts a Node.js process inside the sandbox, which contains two V8 vm contexts (trusted and untrusted) sharing the same V8 isolate and heap.

• The trusted context attaches a freshly generated random token to requests sent to the native Rust parent process. Untrusted code takes a heap snapshot using v8.getHeapSnapshot() and tests UUID-shaped strings as candidate tokens.

• Incorrect tokens return authorization errors, while a combination of a correct token and invalid arguments returns validation errors, allowing the response difference to serve as an oracle to identify the token.

• The untrusted code writes JSON Lines requests to the same standard output pipe as the trusted context. The native parent process validates the token and processes it as a regular request.

• In the PoC, the macOS open command was launched outside the sandbox. The researchers explained that the recovered token could also be used to connect to Unix sockets, including a Docker daemon socket, and to invoke the tool that edits the global Codex configuration.



4. Attacker Position and Execution Location


• Attackers can start from an untrusted repository opened by a developer in Codex or instructions passed from its content to the agent.

• Overpatch is carried out through the Codex CLI patch tool and a symbolic link within the workspace, with the final command executed on the host during the next shell startup.

• Heapjack's untrusted JavaScript runs inside the sandbox, but retrieves the token from the same heap and sends requests to the native node_repl parent process outside the sandbox.

• The PoCs were demonstrated in a research environment; no specific attackers or actual damage have been reported.



5. Victim and Administrator Perspective


•
Victims: In Heapjack, even asking a question about a repository in read-only mode can launch host-side applications without an approval prompt or screen display. In Overpatch, there is no clear warning during patch processing, and the injected command executes when the terminal is next launched.

•
Administrators: Evidence includes node_repl settings in ~/.codex/config.toml, symbolic links pointing from inside the workspace to the home directory, unexpected changes to .zshrc, and open executions or Unix socket connections from Codex-related processes.



6. Success and Failure Conditions




Success Conditions


•
Overpatch: Using an unpatched version of the Codex CLI in workspace-write mode, and allowing the agent to combine a patch containing paths like /tmp with symbolic links inside the workspace.

•
Heapjack: Utilizing node_repl added to global settings by an unpatched version of Codex Desktop, allowing untrusted JavaScript to access the heap snapshot and the shared pipe to the parent process.

• A developer loads an untrusted repository into Codex, and its contents affect agent tool execution.



Failure Conditions


• Updating to Codex CLI 0.149.0 or later and Codex Desktop build 26.818.21641 or later, as indicated by Accomplish as patched versions.

• Containing the agent, tools, and child processes within a VM boundary separate from the host, ensuring host credentials and Docker sockets are not passed to the guest. This is an additional defense adopted by Accomplish and does not replace applying the patched versions.

• Controlling access to paths outside the workspace, symbolic links, global settings, and Unix sockets using both policies and telemetry.



7. What Happens Upon Success


• Overpatch allows writing to files outside the workspace and executing commands on the host during the next terminal startup by modifying shell settings.

• Heapjack allows calling native parent process functions outside the sandbox even in read-only mode, including launching host-side applications, connect to Unix sockets, and modify global Codex configurations.

• In configurations where the native helper can reach a Docker daemon socket, container-level impact may be possible. The researchers identified the socket as reachable with the recovered token but did not report a successful Docker host compromise.

• Subsequent access to credentials, source code, signing keys, and cloud sessions available on the host depends on the environment; public materials report no actual damage.



8. Observable Logs


•
Email: No email-based attack vectors have been reported.

•
Proxy / SWG / DNS: Check for cloning/fetching of untrusted repositories and new outbound traffic from processes launched outside the sandbox. Since the sandbox escape itself occurs between local processes, it cannot be detected via network logs alone.

•
Endpoint / EDR: Check for behavior associated with heap snapshot acquisition from Codex/Node.js, open execution from the native node_repl parent process, changes to .zshrc and ~/.codex/config.toml, and writes outside the workspace via symbolic links.

•
Identity / IdP: Check authentication and token usage for developer tokens, GitHub credentials, cloud sessions, and signing credentials that were available after the sandbox escape. The article does not report actual credential abuse.

•
SaaS / Cloud: Check connected GitHub or cloud services for unknown API calls, repository changes, token issuance, and access to secrets following Codex execution timestamps.

•
Network: Where host-level socket telemetry is available, check for connections from Codex-related processes to Unix sockets, Docker daemon sockets, and local services. Separately review outbound traffic from applications or processes launched after the relevant Codex activity.



9. Attack Success Determination




Confirmed in Public Information


•
Initial Execution Confirmed (Research Environment): For Overpatch, appending to .zshrc and executing commands upon the next terminal startup was verified; for Heapjack, executing the macOS open command from read-only mode via the native parent process was verified.

•
Actual Damage Unconfirmed: Public materials report no instances of these methods being used in real-world attacks, credential theft, repository tampering, or Docker host compromise.



Internal Determination Criteria


•
Initial Execution Confirmed: Cross-reference Codex session/tool logs, patch contents, file metadata, and process telemetry to substantiate writes outside the workspace or host command execution via the native parent process.

•
Information Theft or Session Compromise Confirmed: Confirm evidence that the post-sandbox-escape process accessed credential files, keychains, agent sockets, or cloud tokens, and that those credentials were used in another session or from an external system.

•
Subsequent Compromise Confirmed: Substantiate unauthorized modifications in GitHub/cloud, Docker daemon operations, additional payload execution, or persistence.



10. Investigation Playbook


•
Trigger: Start with open execution from Codex, changes to .zshrc / global Codex settings, writes outside the workspace, or unknown Docker API operations.

•
Initial Verification: Check Codex CLI/Desktop versions, execution modes, target repositories, session logs, tool calls, patch contents, and node_repl settings.

•
Endpoint: Preserve .zshrc, ~/.codex/config.toml, symbolic links within the workspace, process trees, file metadata, shell startup history, and heap-snapshot-related artifacts.

•
Authentication and Cloud: Enumerate GitHub, cloud, package registry, signing, and SSH credentials accessible from the host, and check usage history after Codex sessions.

•
Subsequent Operations: Track access to Unix sockets/Docker daemons, host-side applications, child processes, outbound traffic, and repository/cloud changes.

•
Containment: Terminate the affected Codex session and isolate the affected host from the network. Update to patched versions, revert unauthorized changes outside the workspace, and revoke/reissue potentially exposed credentials.

•
Classification: Separate untrusted repository loading, tool abuse, sandbox escape, host command execution, credential access, unauthorized use, and subsequent modifications.



11. Defense and Detection Ideas


•
Single Events: Detect operations where the Codex patch tool references paths outside the workspace, writes to the home directory from workspace-internal symbolic links, and open or Docker socket accesses from Codex-related processes.

•
Timeline Correlation: Correlate cloning of untrusted repositories, Codex session initiation, patch/node_repl usage, global/shell setting modifications, host-side process launches, and credential usage.

•
Threat Hunting: Search for change histories of .zshrc and ~/.codex/config.toml, symbolic links pointing from the workspace to the home directory, application launches outside Codex parent-child processes, and unexpected Docker operations.

•
Log Gaps: Agent logs alone may overlook execution in native parent processes or subsequent shells. Record tool calls, file integrity, processes, local sockets, and credential usage on the host side.

•
Priority Countermeasures: Prioritize updating Codex CLI/Desktop, isolating untrusted repositories, separating host credentials and Docker sockets, monitoring writes outside the workspace, and enforcing least privilege for connected services.



12. Facts / Inference / Hypothesis




Facts


• Accomplish reported two issues to OpenAI on August 12, 2026, stating they were fixed within eight days.

• The Overpatch PoC expanded the allowed range to / by specifying /tmp in the patch and appended to $HOME/.zshrc via a symbolic link.

• The Heapjack PoC identified trusted tokens from the same V8 heap, wrote requests to the shared pipe to the native parent process, and executed the macOS open command from read-only mode.

• Accomplish lists Codex CLI 0.149.0 and later, and Codex Desktop build 26.818.21641 and later as patched versions. The changelog for OpenAI's Codex CLI 0.149.0 release lists Prevent apply_patch from widening write permissions (#39614), Harden unsandboxed patch filesystem access (#39659), and Prevent Node REPL auth tokens from reaching child processes (#39301). It does not name the findings as Overpatch or Heapjack and does not document the Codex Desktop fix.

• Exploitation in real-world attacks and actual damage have not been reported.



Inference


• A trust boundary cannot safely rely only on checks performed inside the component it is intended to constrain, particularly when tools derive permissions from untrusted input or authorization secrets share memory with untrusted code.

• Running the agent in a VM separate from the host and withholding host credentials and privileged sockets can reduce the blast radius if the application sandbox is breached. Patched versions and least-privilege access to connected services are still required.



Hypothesis


No additional hypotheses. Unconfirmed items are listed in the "Unknowns and Further Investigation" section.



13. MITRE ATT&CK Mapping


•
T1203 Exploitation for Client Execution (Confidence: high): Starting from a developer handling an untrusted repository in Codex, client-side sandbox implementations are abused to proceed to code execution on the host.

•
T1546.004 Event Triggered Execution: Unix Shell Configuration Modification (Confidence: high): Overpatch appends commands to .zshrc and uses the next shell startup as the execution trigger.



14. Unknowns and Further Investigation


• The exact minimum versions affected by both issues and differences across operating systems.

• The full scope of node_repl operations available in Heapjack and native parent process functions per OS.

• The presence or absence of real-world exploitation, malicious repositories, credential theft, and repository/cloud modifications.

• Official advisories published by OpenAI explicitly mapping Overpatch/Heapjack, and official release information and fix details for Codex Desktop build 26.818.21641 cited by Accomplish.



15. Impact on SOCs and Organizations


Running an AI coding agent in read-only mode is useful, but this case shows that the mode label alone does not define the host's exposure. The trust boundary must include tools, native helpers, shared memory, local sockets, and connected services. Because developer workstations often hold GitHub, cloud, package-registry, and code-signing credentials, organizations should combine agent version management with isolated environments for untrusted repositories, exclusion of host credentials, least-privilege access to connected services, and host-level telemetry.



16. Summary by Target Audience


•
For SOCs: Review timelines encompassing not only Codex sessions, but also file modifications outside the workspace, host-side processes from native parent processes, Unix sockets, and credential usage.

•
For Administrators: Update to Codex CLI 0.149.0 or later and Desktop build 26.818.21641 or later, and separate host credentials and privileged sockets from environments handling untrusted repositories.

•
For Users: Update Codex to the latest version, avoid opening unknown repositories directly on primary development endpoints, and report unexpected tool execution or setting changes to administrators.