OpenAI builds custom Windows sandbox for Codex coding agent after existing tools proved insufficient
OpenAI has implemented a custom sandbox for its Codex coding agent on Windows after determining that existing Windows isolation tools—AppContainer, Windows Sandbox, and Mandatory Integrity Control—could not adequately balance safety and functionality. The solution uses synthetic SIDs and write-restricted tokens to constrain file writes and network access without requiring administrator privileges.
OpenAI builds custom Windows sandbox for Codex coding agent after existing tools proved insufficient
OpenAI has implemented a custom sandbox environment for its Codex coding agent on Windows after determining that existing Windows isolation mechanisms could not adequately balance safety with developer productivity. The company evaluated and rejected AppContainer, Windows Sandbox, and Mandatory Integrity Control (MIC) before building its own solution.
The problem with existing Windows tools
According to David Wiesen, member of OpenAI's technical staff, when he joined the Codex engineering team in September 2025, Windows users faced two suboptimal choices: manually approving nearly every command Codex wanted to execute, or enabling Full Access mode with no restrictions.
OpenAI evaluated three existing Windows isolation mechanisms:
AppContainer offered OS-level isolation but proved too restrictive for Codex's open-ended developer workflows. The tool is designed for apps that know their exact access requirements upfront, while Codex needs to drive arbitrary shells, Git operations, Python environments, package managers, and build tools.
Windows Sandbox provides strong VM-based isolation but operates in a disposable environment separate from the user's actual development workspace. Additionally, Windows Sandbox is unavailable on Windows Home editions, limiting its viability.
Mandatory Integrity Control (MIC) labeling appeared promising initially—running Codex at low integrity while relabeling writable directories would let Windows enforce write restrictions. However, marking a workspace as low integrity affects all low-integrity processes system-wide, not just Codex, creating broader security risks than targeted access controls.
The custom solution
OpenAI's implementation, called the "unelevated sandbox," uses two Windows primitives: security identifiers (SIDs) and write-restricted tokens. The design does not require administrator privileges.
The sandbox creates synthetic SIDs—security identifiers that don't correspond to real users but can appear in access control lists (ACLs). A dedicated "sandbox-write" SID is granted write, execute, and delete access only to specific directories where Codex should operate.
Write-restricted tokens enforce a dual-check system: for any write operation to succeed, both the normal user identity and at least one SID from the token's restricted list must have permission. This allows precise filesystem write control through ACLs.
Codex runs with the permissions of the user by default, making it both powerful and potentially dangerous. The sandbox constrains this by allowing Codex to read files broadly while restricting writes to the user's workspace directory, with no internet access unless explicitly specified.
What this means
The implementation highlights a gap in Windows' native sandboxing capabilities for developer tools that need flexible, fine-grained isolation. While macOS offers Seatbelt and Linux provides seccomp or bubblewrap, Windows lacked an equivalent solution for Codex's use case. OpenAI's approach demonstrates that building developer-focused isolation on Windows requires combining lower-level primitives rather than using existing high-level tools. The solution enables Windows users to run Codex with the same safety and convenience available on other platforms, without compromising on either security or developer experience.
Related Articles
OpenAI research ties shrinking chain-of-thought transparency in GPT-6 Astra to training choices on capability and cost
OpenAI's safety team analyzed models from GPT-5 through GPT-6 Astra and traced the loss of chain-of-thought monitorability to four training factors. The data suggest the erosion reflects tradeoffs between safety, capability and compute cost, not an unavoidable law.
Grok Bot for Mac adds Messages, Mail, Notes, Reminders, Calendar, Location and Contacts access
Grok Bot on Mac can now use Messages, Mail, Notes, Reminders, Calendar, Location and Contacts, according to the app's @bot account on X on November 12, 2026. 9to5Mac reports the app reached version 1.0 this month, leaving beta.
Anthropic Launches Claude for Manufacturing, a 17-Skill Plugin for Quoting, Quality and Maintenance
Anthropic launched Claude for Manufacturing on November 12, 2026. The plugin has 17 skills for quoting, quality investigations, production reporting, maintenance diagnosis, sourcing and design. It works from a manufacturer's existing records and sends processes to employee review.
Anthropic launches self-hosted Claude Managed Agents for customer cloud accounts and on-premises data centers
Anthropic launched self-hosted Claude Managed Agents on November 12, 2026. Customers can run the full service and its sandboxes in their own cloud account or on-premises data center, with agents, sessions and session history stored on that infrastructure.
Comments
Loading...