Dispatch
OpenAI Codex Windows Sandbox — Engineering Deep Dive on Secure Agent Execution via Preflight Audits and ACL Management
OpenAI published detailed engineering on how Codex sandboxes agents on Windows: dedicated lower-privilege sandbox users, filesystem permission boundaries, firewall rules, and preflight audits that scan for world-writable directories before spawning processes. The sandbox restricts write access to workspace directories only, with no internet by default. Addresses the gap from March 2026 Windows launch where sandbox was optional.
Source
↳ Follow the thread