What happened
OpenAI's engineering team designed and built a custom sandbox—a restricted execution environment—for Codex, its coding agent, on Windows. Existing Windows isolation tools like AppContainer, Windows Sandbox, and Mandatory Integrity Control were evaluated and rejected as non-starters. The final design uses two new local users (CodexSandboxOffline and CodexSandboxOnline), firewall rules to block outbound traffic for the offline user, and two new binaries: codex-windows-sandbox-setup.exe and codex-command-runner.exe.
Why it matters
Before this, Windows users had to choose between approving nearly every command or enabling Full Access mode, which lets Codex run without oversight. A sandbox enforces safe file and network limits automatically. The team notes that Windows doesn't provide a built-in isolation utility like Seatbelt on macOS or seccomp/bubblewrap on Linux, so they had to implement their own solution. The elevated sandbox requires admin permissions at setup time.
What to watch
The sandbox's effectiveness hinges on whether the firewall rules and dedicated user accounts adequately block malicious code from exfiltrating data. The design balances safety with usefulness—the goal is for Codex to handle real developer workflows without constant user approval. This is the current implementation, suggesting OpenAI may continue to refine it based on real-world usage and feedback.
Summaries like this, in your inbox every morning.
The Codex engineering team started this project in September 2025 when Codex for Windows had no sandbox. The initial 'unelevated' prototype used synthetic SIDs and write-restricted tokens to limit file writes, but its network restrictions were only advisory and could be circumvented. This pushed the team to redesign with an 'elevated' approach that uses Windows Firewall and dedicated user accounts.
The final architecture composes multiple Windows primitives—SIDs, restricted tokens, firewall rules, and custom users—into a coherent system. The team emphasizes this complexity was necessary because Windows lacks a single primitive that maps cleanly to a safe autonomous coding agent. They note the security challenge differs from classic application security, requiring a balance between enforcing boundaries and supporting real developer workflows.
The system's success will likely hinge on whether the firewall rules and user-based isolation hold up against adversarial code while remaining transparent enough for legitimate developer tasks. The setup's admin requirement and asynchronous ACL granting suggest potential friction points for users, but the team prioritized effective enforcement over a simpler design.
Pick your industry and the AI tools you use, and get news related to your work every day.
Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.
In Q2, billionaires or their funds sold six 'Magnificent Seven' AI stocks
Nvidia was rising early Friday, even as the wider chip sector kept falling, Barron's reported
ElevenLabs completed a $300 million employee tender at a $22 billion valuation, and co-founder Mati Staniszews…
On October 15, OpenAI announced the Rosalind Academic Plan, giving approved US university labs free access to…
Neostellar Capital principal Evan Schlossman said CoreWeave's $103.7 billion in remaining performance obligati…
Supermicro Computer appointed Mark Long as chief financial officer, bringing an experienced technology finance…
