OpenAI details the Windows sandbox it built for Codex

OpenAI published a technical write-up on the Windows sandbox it built for Codex. Windows users previously had to either approve nearly every command, including many reads, or run Codex with full local access.

The design target was a Windows sandbox that lets Codex read broadly, write inside the workspace, and block unapproved internet access with operating-system-enforced controls. OpenAI evaluated AppContainer, Windows Sandbox, and Mandatory Integrity Control and rejected each for Codex’s open-ended developer workflow requirements.

The first prototype used synthetic SIDs and write-restricted tokens to control filesystem writes. The design granted writes to the current working directory and configured writable roots while explicitly denying writes to paths such as `.git`, `.codex`, and `.agents` inside those roots.

The early network-control layer used fail-closed environment overrides such as proxy poisoning and Git transport restrictions, but that layer remained advisory because child processes could bypass it or open sockets directly.

Source: OpenAI — https://openai.com/index/building-codex-windows-sandbox/