Hazem Omier(@hazemomier):Third coding-agent sandbox escape in a row from the same research shop. Pattern is the product, not the CVE number. Heapjack: read-only mode, no approval prompt, unsandboxed host command via a shared V8 heap token. Overpatch: apply_patch widens write past the workspace. Fixed fast (Desktop 26.818.21641 / CLI 0.149.0). Forced choice when you put Codex on a laptop: treat every opened repo as hostile code, or keep the agent in a real VM boundary. Sandbox labels are marketing until the boundary is proven.

2026.09.20 13:38

Third coding-agent sandbox escape in a row from the same research shop. Pattern is the product, not the CVE number. Heapjack: read-only mode, no approval prompt, unsandboxed host command via a shared V8 heap token. Overpatch: apply_patch widens write past the workspace. Fixed fast (Desktop 26.818.21641 / CLI 0.149.0). Forced choice when you put Codex on a laptop: treat every opened repo as hostile code, or keep the agent in a real VM boundary. Sandbox labels are marketing until the boundary is proven.