NEWSCORRECTIONS
Friday, September 25, 2026
Truth, centered.
Technology ← Home

On September 20, 2026 BleepingComputer's Ax Sharma reported that Accomplish AI researcher Oren Yomtov reported two Codex sandbox escapes to OpenAI on August 12 and that both were fixed within eight days, that Heapjack targets Codex Desktop node_repl in global ~/.codex/config.toml with a shared V8 heap enabling stolen-token read-only-mode RCE when a user opens a hostile repository and asks a question, producing unsandboxed host commands with no approval prompt, that Overpatch in Codex CLI workspace-write lets apply_patch widen write permission via a /tmp path toward root and append to .zshrc via symlink, that OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0, and that OpenAI thanked the researchers, said the issues were addressed in August, and is continually strengthening sandboxes; Cyber Security News and Fudzilla framed the same Heapjack and Overpatch pair as distinct from prior Plugin4Shell coverage; unfinished Codex sandbox-escape patches plus unfinished update-adoption clocks is not already every Codex user already owned forever and not already AI coding agents proven unfixable forever

NewsCorrections Staff · Monday, September 21, 2026 · 5 min read
Corrected from Bleepingcomputer: “Unfinished Codex sandbox-escape patches plus unfinished update-adoption clocks are not already every Codex user already owned forever and not already AI coding agents proven unfixable forever”

On September 20, 2026 BleepingComputer reported that Accomplish AI researcher Oren Yomtov disclosed two Codex sandbox escapes to OpenAI on August 12 and that both were fixed within eight days. Heapjack abuses Codex Desktop's node_repl in global ~/.codex/config.toml and a shared V8 heap to steal a token and run unsandboxed host commands from read-only mode after a user opens a hostile repository and asks a question. Overpatch lets Codex CLI apply_patch widen writes via a /tmp path toward root and reach .zshrc via symlink in workspace-write mode. OpenAI fixed Heapjack in Desktop build 26.818.21641 and Overpatch in CLI 0.149.0, thanked researchers, and said the issues were addressed in August while continually strengthening sandboxes. Cyber Security News and Fudzilla covered the same pair. Unfinished Codex sandbox-escape patches plus unfinished update-adoption clocks are real. They are not already every Codex user already owned forever, and they are not already AI coding agents proven unfixable forever.

On September 20, 2026 BleepingComputer's Ax Sharma reported that Accomplish AI researcher Oren Yomtov reported two Codex sandbox escapes to OpenAI on August 12 and that both were fixed within eight days, that Heapjack targets Codex Desktop node_repl in global ~/.codex/config.toml with a shared V8 heap enabling stolen-token read-only-mode RCE when a user opens a hostile repository and asks a question, producing unsandboxed host commands with no approval prompt, that Overpatch in Codex CLI workspace-write lets apply_patch widen write permission via a /tmp path toward root and append to .zshrc via symlink, that OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0, and that OpenAI thanked the researchers, said the issues were addressed in August, and is continually strengthening sandboxes; Cyber Security News and Fudzilla framed the same Heapjack and Overpatch pair as distinct from prior Plugin4Shell coverage; unfinished Codex sandbox-escape patches plus unfinished update-adoption clocks is not already every Codex user already owned forever and not already AI coding agents proven unfixable forever
Photo: Original photo via bleepingcomputer.com
By the Numbers
Aug 12
BleepingComputer/Yomtov: report date to OpenAI; both escapes fixed within 8 days
26.818.21641
Accomplish/BleepingComputer: Codex Desktop build fixing Heapjack
0.149.0
Accomplish/BleepingComputer: Codex CLI version fixing Overpatch
Synthesized from 3 sources click any to read the original
BleepingcomputerCybersecuritynewsFudzilla

BleepingComputer's Ax Sharma reported September 20, 2026 that Accomplish AI researcher Oren Yomtov reported two Codex sandbox escapes to OpenAI on August 12 and that both were fixed within eight days, that Heapjack targets Codex Desktop's node_repl written into global ~/.codex/config.toml with a shared V8 heap that can yield a stolen token and read-only-mode remote code execution when a user opens a hostile repository and asks a question, producing unsandboxed host commands with no approval prompt, that Overpatch sits in Codex CLI workspace-write mode where apply_patch can widen write permission via a /tmp path toward root and can append to .zshrc via symlink, that OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0, and that OpenAI told BleepingComputer it thanked the researchers, addressed the issues in August, and is continually strengthening sandboxes. Cyber Security News and Fudzilla framed the same Heapjack and Overpatch pair as distinct from the earlier Plugin4Shell story already covered in a prior batch. Those are unfinished Codex sandbox-escape patch facts plus unfinished update-adoption clock facts. They are not proof every Codex user is already owned forever, and they are not proof AI coding agents are already proven unfixable forever.

That is an unfinished Codex sandbox-escape patch layered on unfinished update-adoption clocks. It is not a finished every-Codex-user-already-owned-forever certificate, and it is not a finished AI-coding-agents-proven-unfixable-forever certificate.

## What They Reported

BleepingComputer framed Yomtov's August 12 report, the eight-day fix window, Heapjack's node_repl and shared-heap token theft path to unsandboxed host commands from read-only mode after opening a hostile repo, Overpatch's apply_patch write widening via /tmp toward root and symlink .zshrc risk, Desktop build 26.818.21641 and CLI 0.149.0 as the fixes, and OpenAI's statement thanking researchers while saying the issues were addressed in August with ongoing sandbox hardening. Cyber Security News repeated the Heapjack and Overpatch mechanics and fix versions. Fudzilla stressed two escape hatches, the hostile-repo question path, and the update call. Named journalism published unfinished patched escapes and unfinished update-adoption facts. It did not publish that every Codex user was already owned forever or that AI coding agents were already proven unfixable forever.

Security feeds often compress "sandbox escape" plus "unsandboxed host commands" into "every Codex user already owned forever," or compress "two escape hatches" into "AI coding agents already proven unfixable forever." Both habits flatten what BleepingComputer, Cyber Security News, and Fudzilla published: unfinished Codex sandbox-escape patches plus unfinished update-adoption clocks, not finished forever universal ownership and not finished forever unfixability.

## The Correction

Three corrections are required at once.

First, treating Heapjack's read-only-mode RCE path and Overpatch's write-widening path as proof every Codex user is already owned forever invents finished forever universal compromise from unfinished patched flaws. Yomtov's report date, the eight-day remediation, Desktop build 26.818.21641, and CLI 0.149.0 are unfinished patch-and-version facts, not every Codex user already owned forever.

Second, treating two named escapes and similar trust-boundary problems across AI coding agents as proof AI coding agents are already proven unfixable forever invents finished forever unfixability from unfinished engineering debt. OpenAI's statement that the issues were addressed in August and that sandboxes are continually being strengthened is unfinished hardening language, not AI coding agents already proven unfixable forever. Unfinished patch clocks are not already AI coding agents proven unfixable forever, and unfinished patch clocks are not already every Codex user already owned forever.

Third, treating update-adoption uncertainty, the global ~/.codex/config.toml inheritance for CLI users, and the hostile-repo question trigger as proof either that every Codex user is already owned forever or that AI coding agents are already proven unfixable forever invents finished end-states from unfinished adoption clocks. Users who have not yet updated sit on an unfinished adoption clock, not on finished forever universal ownership, and not on finished forever unfixability. This story is Heapjack and Overpatch, not the earlier Plugin4Shell item.

Accurate language therefore holds three layers apart. Layer one: September 20, 2026 BleepingComputer (Ax Sharma), Cyber Security News, and Fudzilla reported that Oren Yomtov of Accomplish AI disclosed two Codex sandbox escapes fixed within eight days of an August 12 report. Layer two: Heapjack - Codex Desktop node_repl in global ~/.codex/config.toml; shared V8 heap; stolen token; read-only mode RCE via hostile repo plus question; unsandboxed host commands; no approval prompt; fixed in Desktop build 26.818.21641; Overpatch - Codex CLI workspace-write; apply_patch widens write via /tmp path toward root; .zshrc via symlink; fixed in CLI 0.149.0; OpenAI thanked researchers, said addressed in August, continually strengthening sandboxes; distinct from prior Plugin4Shell coverage. Layer three: unfinished Codex sandbox-escape patches plus unfinished update-adoption clocks is not already every Codex user already owned forever and not already AI coding agents proven unfixable forever.

## Why This Matters

AI-agent security headlines overreact because "sandbox escape" and "unsandboxed host commands" travel faster than the difference between an unfinished patched flaw and every Codex user already owned forever, and faster than unfinished update-adoption clocks versus AI coding agents already proven unfixable forever.

False already-every-user-owned claims confuse developers about still-shipped Desktop and CLI fixes and still-live update status on their machines. False already-proven-unfixable claims erase the eight-day remediation and OpenAI's stated August fixes. Accurate coverage can report real Heapjack and Overpatch escapes without converting unfinished patches and adoption clocks into finished forever catastrophe theater.

NewsCorrections technology rule: unfinished Codex sandbox-escape patches and unfinished update-adoption clocks are not already every Codex user already owned forever and not already AI coding agents proven unfixable forever.

## Key Takeaways

Read the original from Bleepingcomputer
View the source article we corrected →
Source Bias Analysis
LEFT
40%
RIGHT
20%
✓ NewsCorrections: 0% Bias Analyzed from 3 sources
See What We Corrected +
What We Corrected
Original from Bleepingcomputer
“Unfinished Codex sandbox-escape patches plus unfinished update-adoption clocks are not already every Codex user already owned forever and not already AI coding agents proven unfixable forever”
✓ NewsCorrections Version
“On September 20, 2026 BleepingComputer's Ax Sharma reported that Accomplish AI researcher Oren Yomtov reported two Codex sandbox escapes to OpenAI on August 12 and that both were fixed within eight days, that Heapjack targets Codex Desktop node_repl in global ~/.codex/config.toml with a shared V8 heap enabling stolen-token read-only-mode RCE when a user opens a hostile repository and asks a question, producing unsandboxed host commands with no approval prompt, that Overpatch in Codex CLI workspace-write lets apply_patch widen write permission via a /tmp path toward root and append to .zshrc via symlink, that OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0, and that OpenAI thanked the researchers, said the issues were addressed in August, and is continually strengthening sandboxes; Cyber Security News and Fudzilla framed the same Heapjack and Overpatch pair as distinct from prior Plugin4Shell coverage; unfinished Codex sandbox-escape patches plus unfinished update-adoption clocks is not already every Codex user already owned forever and not already AI coding agents proven unfixable forever”
Source: Bleepingcomputer • Bias neutralized • Language corrected
Go Deeper
+

+

+

Test Your Mind · from the makers of NewsCorrections

Real World IQ

How smart are you really? The most comprehensive IQ assessment ever built, from Guinness World Records Puzzle Master Timothy E. Parker.

Take the Test →

Related Stories

On September 23, 2026 9to5Mac's Marcus Mendes reported, citing Financial Times coverage of an OpenAI court filing in the SpaceXAI/xAI antitrust case, that Apple Intelligence ChatGPT integration dramatically underperformed after the 2024 launch, that OpenAI expected a halo effect, that usage slowed within a month, that the company cut weekly active user forecasts, and that by summer 2025 the integration was dramatically underperforming; MacRumors reported persistently underperforming results, opt-in and off-by-default friction, a non-exclusive deal, and Apple later turning toward Gemini for Siri AI; AppleInsider reported ChatGPT as a Siri extension dramatically underperformed per OpenAI, that OpenAI seeks a pretrial ruling, and that trial is set for January; unfinished Apple-OpenAI underperformance filing plus unfinished antitrust and partnership clocks is not already ChatGPT on iPhone already dead forever and not already Apple-OpenAI alliance already finished forever
Photo: Original photo via 9to5mac.com
Technology 12 hours ago

On September 23, 2026 9to5Mac's Marcus Mendes reported, citing Financial Times coverage of an OpenAI court filing in the SpaceXAI/xAI antitrust case, that Apple Intelligence ChatGPT integration dramatically underperformed after the 2024 launch, that OpenAI expected a halo effect, that usage slowed within a month, that the company cut weekly active user forecasts, and that by summer 2025 the integration was dramatically underperforming; MacRumors reported persistently underperforming results, opt-in and off-by-default friction, a non-exclusive deal, and Apple later turning toward Gemini for Siri AI; AppleInsider reported ChatGPT as a Siri extension dramatically underperformed per OpenAI, that OpenAI seeks a pretrial ruling, and that trial is set for January; unfinished Apple-OpenAI underperformance filing plus unfinished antitrust and partnership clocks is not already ChatGPT on iPhone already dead forever and not already Apple-OpenAI alliance already finished forever

Corrected from 9to5mac

On September 23, 2026 9to5Mac reported that an OpenAI court filing said Apple Intelligence ChatGPT integration dramatically underperformed after the 2024 launch, with a slow start, cut WAU forecasts, and summer 2025 underperformance after an expected halo effect. MacRumors reported persistently underperforming results, opt-in friction, a non-exclusive deal, and Apple's later Gemini path for Siri AI. AppleInsider reported OpenAI seeking a pretrial ruling with trial set for January. Unfinished Apple-OpenAI underperformance filing plus unfinished antitrust and partnership clocks are real. They are not already ChatGPT on iPhone already dead forever, and they are not already Apple-OpenAI alliance already finished forever.

Neutralized from 3 sources
Meta Working on Muse AI Integration for Smart Glasses Unveiled at Connect
Technology 1 day ago

Meta Working on Muse AI Integration for Smart Glasses Unveiled at Connect

Corrected from Techcrunch

The Verge and Business Insider reported Meta is working on bringing its Muse AI agent to smart glasses including new models from Meta Connect. TechCrunch coverage framed related efforts around VR glasses with IMAX options and separately camera-free AI glasses with 12 hours battery life. No conflicting facts appear across the reports on Muse's planned glasses integration.

Neutralized from 4 sources
On September 22, 2026 TechCrunch's Russell Brandom reported that Anthropic released Claude Opus 5.5 with claimed state-of-the-art coding and knowledge-work performance that outpaces larger Fable on many benchmarks, output tokens at $20 per million versus $25 previously, cheaper and faster generation, less jargon, and important information first, that Opus 5 shipped July 24 with Sonnet 5.5 and Haiku 5.5 coming in weeks, that Opus 5.5 is comparable to Mythos in biology and cybersecurity so Fable-level safeguards limit exploit discovery and biological-weapons tasks, that it is the first model since Dario Amodei's pace-the-frontier post, and that METR and Frontier Design did external testing; The Verge reported stronger safeguards after rogue AI hacking concerns, 85% fewer boundary-circumvention attempts versus Opus 5 and Mythos 5.1, cybersecurity requests re-routed to Opus 4.8, biology to Opus 5, about 40% lower typical-workload cost, and matching Fable 5.1 on most work; SiliconANGLE reported OpenAI countered the same day with GPT-6 Sol and Luna at lower prices, Opus input $4 per million and output $20 per million, Terminal-Bench 4.0 at 66.4% versus Fable 5.1 at 55.8%, and AutomationBench at 40% versus Opus 5 at 26.9%; unfinished Opus 5.5 launch plus unfinished safety and rival-price clocks is not already AI frontier paced forever and not already Anthropic won model race forever
Photo: Original photo via techcrunch.com
Technology 1 day ago

On September 22, 2026 TechCrunch's Russell Brandom reported that Anthropic released Claude Opus 5.5 with claimed state-of-the-art coding and knowledge-work performance that outpaces larger Fable on many benchmarks, output tokens at $20 per million versus $25 previously, cheaper and faster generation, less jargon, and important information first, that Opus 5 shipped July 24 with Sonnet 5.5 and Haiku 5.5 coming in weeks, that Opus 5.5 is comparable to Mythos in biology and cybersecurity so Fable-level safeguards limit exploit discovery and biological-weapons tasks, that it is the first model since Dario Amodei's pace-the-frontier post, and that METR and Frontier Design did external testing; The Verge reported stronger safeguards after rogue AI hacking concerns, 85% fewer boundary-circumvention attempts versus Opus 5 and Mythos 5.1, cybersecurity requests re-routed to Opus 4.8, biology to Opus 5, about 40% lower typical-workload cost, and matching Fable 5.1 on most work; SiliconANGLE reported OpenAI countered the same day with GPT-6 Sol and Luna at lower prices, Opus input $4 per million and output $20 per million, Terminal-Bench 4.0 at 66.4% versus Fable 5.1 at 55.8%, and AutomationBench at 40% versus Opus 5 at 26.9%; unfinished Opus 5.5 launch plus unfinished safety and rival-price clocks is not already AI frontier paced forever and not already Anthropic won model race forever

Corrected from Techcrunch

On September 22, 2026 TechCrunch reported that Anthropic released Claude Opus 5.5 with claimed state-of-the-art coding and knowledge-work results, lower output pricing at $20 per million tokens, and Fable-level safeguards for biology and cybersecurity risk. The Verge reported 85% fewer boundary-circumvention attempts, task re-routing for cyber and biology requests, about 40% lower typical-workload cost, and performance matching Fable 5.1 on most work. SiliconANGLE reported same-day OpenAI GPT-6 Sol and Luna counters plus Terminal-Bench 4.0 at 66.4% versus Fable 5.1 at 55.8%. Unfinished Opus 5.5 launch plus unfinished safety and rival-price clocks are real. They are not already AI frontier paced forever, and they are not already Anthropic won model race forever.

Neutralized from 3 sources