OpenAI explains the native Windows sandbox built for Codex

OpenAI published the design of its Codex sandbox for Windows on May 13. The work addresses a difficult product boundary: a coding agent must run shells, compilers, package managers, and arbitrary project tools, while limiting writes outside the workspace and suppressing network access unless the user allows it. Existing Windows isolation options did not match that combination of broad tool compatibility and direct access to a real checkout.

The sandbox is an operating-system boundary

The article compares AppContainer, Windows Sandbox, and Mandatory Integrity Control before explaining OpenAI’s own design. AppContainer expected a narrower, predefined capability set. A disposable Windows Sandbox VM did not naturally operate on the user’s installed tools and working tree. Relabeling a workspace at low integrity changed who else on the machine could write to it.

OpenAI instead built around Windows security identifiers, access-control lists, restricted process tokens, and job constraints. The sandbox gives the agent a distinct identity, grants that identity write access only to selected roots, and ensures child processes inherit restrictions. The team also moved toward an elevated setup phase so enforcement could include network suppression rather than depending on a cooperative process.

Compatibility is part of the security design

A sandbox that blocks normal builds will be disabled, so correctness includes both escape resistance and developer-tool compatibility. Teams building similar local agents should test junctions and symbolic links, inherited ACLs, child-process trees, named pipes, credential stores, localhost access, and package-manager caches. Setup and runtime privileges should be separately auditable.

OpenAI’s account is a useful reminder that “workspace write access” is not a single permission switch on Windows. It is a composed policy whose guarantees depend on identity, token construction, filesystem traversal, network enforcement, and how every descendant process is launched.