On May 13, 2026, OpenAI engineer David Wiesen published a technical account of the sandbox developed to run Codex on Windows. The post describes why existing Windows primitives were insufficient and how the team iterated from an unelevated prototype to an elevated sandbox that requires admin setup.
Why a Windows sandbox was needed
Codex runs on developer machines through the CLI, an IDE extension, or the desktop app and by default has the permissions of the logged-in user. The default policy described by the author allows Codex to read files broadly and write only within the active workspace, with no internet access unless explicitly requested. Enforcing those constraints requires operating-system-level isolation, but Windows lacks a single built-in mechanism equivalent to macOS Seatbelt or Linux seccomp/bubblewrap.
Unelevated prototype: SIDs and write-restricted tokens
The initial prototype aimed to avoid admin elevation. It used synthetic SIDs and write-restricted tokens so the sandbox had a distinct identity and ACL-based write permissions. The setup created a synthetic SID (sandbox-write) granted write access to the current working directory and any writable_roots listed in config.toml, while denying it write access to locations such as /.git, /.codex, and /.agents.
Network restrictions were implemented by modifying ENV and PATH to route traffic to a dead proxy and to make Git/SSH fail (examples included HTTPS_PROXY=http://127.0.0.1:9 and GIT_SSH_COMMAND=cmd /c exit 1). The author notes this approach caught many normal tool flows but remained advisory and could be bypassed.
Wiesen attributes several drawbacks to the unelevated design: expensive ACL application depending on workspace topology, an unavoidable on-disk ACL footprint tied to a synthetic SID, slow semantics changes, and weak network suppression.
Elevated sandbox: dedicated users and firewall rules
The revised implementation requires admin permissions at setup and runs sandboxed commands under a restricted token whose principal is a Codex-created local user (CodexSandboxOffline or CodexSandboxOnline). That change enables Windows Firewall rules to be applied to the sandbox principal, improving outbound network control. The post states this design increases setup complexity but provides stronger network enforcement and is the current implementation.
The account of these designs was written by David Wiesen, who joined the Codex engineering team in September 2025, and documents trade-offs the team considered when bringing Codex to Windows.
Original source: OpenAI News