OpenAI has detailed a redesigned Windows sandbox for Codex. Instead of relying mainly on unelevated execution and environment variables, the system gives Codex separate Windows identities: CodexSandboxOffline by default, and CodexSandboxOnline only when network access is explicitly allowed.
The change matters because environment variables can be bypassed by child processes. The new chain uses DPAPI credential isolation, firewall rules, a codex-command-runner.exe broker and process-tree checks before commands run. Write access is kept to the current workspace, with sensitive project directories such as .git, .codex and .agents blocked.
For enterprise buyers, this is not just a technical note. Coding agents are moving from benchmark races to procurement questions: local execution, auditability and incident boundaries. A Windows-level sandbox gives OpenAI a clearer answer for IT teams evaluating Codex on employee machines.
Sources: OpenAI; WinBuzzer; Gadget Hacks, CocoLoop