Affected Systems
OpenAI Codex Desktop (fixed in build 26.818.21641) and Codex CLI (fixed in version 0.149.0). Both vulnerabilities affected all users; Heapjack was default-enabled with no opt-out and impacted CLI users inheriting Desktop config.
Exploitation Status
Proof-of-concept demonstrated by Accomplish AI researchers. Both vulnerabilities (Heapjack and Overpatch) were reported August 12, 2026 and patched within 8 days. No evidence of active exploitation in the wild mentioned.
Business Impact
Developers using vulnerable Codex versions could have arbitrary commands executed on their host machines by opening malicious repositories. Heapjack enabled RCE from read-only mode with no user prompt or visible indication. Overpatch allowed persistent compromise via shell config modification. Attack surface includes any developer workflow involving untrusted code repositories or AI coding agents.
Urgency
🟠Within 24 hours
Recommended Actions
- Update OpenAI Codex Desktop to build 26.818.21641 or later immediately
- Update OpenAI Codex CLI to version 0.149.0 or later immediately
- Audit developer workstations for signs of compromise: check shell config files (.zshrc, .bashrc) for unauthorized modifications and review Docker daemon access logs if exposed via Unix socket
- Review repositories opened in Codex between initial release and patch date (pre-August 20, 2026) for potential malicious code execution
- Implement network segmentation and least-privilege access for developer workstations running AI coding agents to limit blast radius of future sandbox escapes