Vibe Coding
Codex tightened macOS Seatbelt: mutating fcntls blocked, XPC service lookups denied
The 431-commit range between rust-v0.155.1 and rust-v0.156.0-alpha.7 (published 2026-09-19T04:08Z) includes "Block mutating fcntls in restricted macOS Seatbelt policies" (#46500), "Deny XPC service lookups in macOS Seatbelt profiles" (#46583), "Remove com.apple.runningboard from Seatbelt platform defaults" (#46532) and "Preserve macOS Seatbelt exclusions in scratch directories" (#46571). None of this appears in a release body, since every Codex alpha body is 25 bytes. Taken together it closes the class of escapes where sandboxed code reaches out through a macOS system service rather than through the filesystem.
Source
↳ Follow the thread