Codex read its way out of read-only

Heapjack hits Codex Desktop. The node_repl extension runs trusted and untrusted JavaScript contexts in one Node process sharing one heap. Untrusted code reads a UUID auth token via v8.getHeapSnapshot(), reaches the native unsandboxed parent, and can run commands, hit the Docker socket, or write global config. All of it from the strictest, read-only mode, with no prompt and nothing ever shown on screen. The enforcement lived inside what it was supposed to enforce.

Overpatch hits Codex CLI. apply_patch grants write access to each named path's parent directory. Naming /tmp widens that to the disk root, then a symlink appends a line to ~/.zshrc, which runs unsandboxed at the next terminal.

Both share a shape: the enforcement logic sat within the component it was enforcing, so there was no boundary to attack, only a rule to violate. Both were reported August 12 and patched in eight days — Heapjack in Desktop 26.818.21641, Overpatch in CLI 0.149.0. The researchers were Oren Yomtov and the Accomplish AI team.

This is a separate, more severe pair than Pillar Security's July week of sandbox escapes. That series ran CVE-2026-48124 (the Cursor hook flaw, CVSS 8.5, desktop only) plus the other Pillar findings across Codex CLI, Gemini CLI and Antigravity — the single CVE belongs to Cursor alone, so do not treat the two as one event.