OpenAI builds custom Windows sandbox for Codex coding agent after existing tools proved insufficient
OpenAI has implemented a custom sandbox for its Codex coding agent on Windows after determining that existing Windows isolation tools—AppContainer, Windows Sandbox, and Mandatory Integrity Control—could not adequately balance safety and functionality. The solution uses synthetic SIDs and write-restricted tokens to constrain file writes and network access without requiring administrator privileges.
OpenAI builds custom Windows sandbox for Codex coding agent after existing tools proved insufficient
OpenAI has implemented a custom sandbox environment for its Codex coding agent on Windows after determining that existing Windows isolation mechanisms could not adequately balance safety with developer productivity. The company evaluated and rejected AppContainer, Windows Sandbox, and Mandatory Integrity Control (MIC) before building its own solution.
The problem with existing Windows tools
According to David Wiesen, member of OpenAI's technical staff, when he joined the Codex engineering team in September 2025, Windows users faced two suboptimal choices: manually approving nearly every command Codex wanted to execute, or enabling Full Access mode with no restrictions.
OpenAI evaluated three existing Windows isolation mechanisms:
AppContainer offered OS-level isolation but proved too restrictive for Codex's open-ended developer workflows. The tool is designed for apps that know their exact access requirements upfront, while Codex needs to drive arbitrary shells, Git operations, Python environments, package managers, and build tools.
Windows Sandbox provides strong VM-based isolation but operates in a disposable environment separate from the user's actual development workspace. Additionally, Windows Sandbox is unavailable on Windows Home editions, limiting its viability.
Mandatory Integrity Control (MIC) labeling appeared promising initially—running Codex at low integrity while relabeling writable directories would let Windows enforce write restrictions. However, marking a workspace as low integrity affects all low-integrity processes system-wide, not just Codex, creating broader security risks than targeted access controls.
The custom solution
OpenAI's implementation, called the "unelevated sandbox," uses two Windows primitives: security identifiers (SIDs) and write-restricted tokens. The design does not require administrator privileges.
The sandbox creates synthetic SIDs—security identifiers that don't correspond to real users but can appear in access control lists (ACLs). A dedicated "sandbox-write" SID is granted write, execute, and delete access only to specific directories where Codex should operate.
Write-restricted tokens enforce a dual-check system: for any write operation to succeed, both the normal user identity and at least one SID from the token's restricted list must have permission. This allows precise filesystem write control through ACLs.
Codex runs with the permissions of the user by default, making it both powerful and potentially dangerous. The sandbox constrains this by allowing Codex to read files broadly while restricting writes to the user's workspace directory, with no internet access unless explicitly specified.
What this means
The implementation highlights a gap in Windows' native sandboxing capabilities for developer tools that need flexible, fine-grained isolation. While macOS offers Seatbelt and Linux provides seccomp or bubblewrap, Windows lacked an equivalent solution for Codex's use case. OpenAI's approach demonstrates that building developer-focused isolation on Windows requires combining lower-level primitives rather than using existing high-level tools. The solution enables Windows users to run Codex with the same safety and convenience available on other platforms, without compromising on either security or developer experience.
Related Articles
OpenAI builds custom Windows sandbox for Codex coding agent without admin privileges
OpenAI developed a custom sandbox implementation for its Codex coding agent on Windows after existing tools like AppContainer and Windows Sandbox failed to meet requirements. The solution uses synthetic SIDs and write-restricted tokens to constrain file writes and network access without requiring administrator privileges.
OpenAI launches Daybreak security initiative with GPT-5.5-Cyber and Codex Security agent
OpenAI has launched Daybreak, a security-focused AI initiative that uses the Codex Security agent and new GPT-5.5-Cyber models to automatically detect and patch software vulnerabilities. The release follows Anthropic's Claude Mythos announcement by one month.
Xcode 26.5 adds message queuing and clarifying questions for AI coding assistants
Apple released Xcode 26.5 with two new Coding Intelligence features: the ability to queue multiple messages to AI coding assistants without waiting for responses, and agent support for asking clarifying questions before executing tasks. The update builds on agentic coding capabilities introduced in Xcode 26.3, which allowed developers to integrate tools like OpenAI Codex and Anthropic's Claude directly into the IDE.
OpenAI launches Daybreak cybersecurity platform with GPT-5.5 variants for vulnerability detection
OpenAI has launched Daybreak, a cybersecurity platform built on three GPT-5.5 model variants designed to detect software vulnerabilities, generate patches, and validate fixes in enterprise codebases. The platform directly competes with Anthropic's Mythos and includes partnerships with eight major security companies including Cisco, Cloudflare, and CrowdStrike.
Comments
Loading...