Allow Windows users to run Codex in "no sandbox" mode and explicitly approve/deny commands
What variant of Codex are you using?
CLI
What feature would you like to see?
Currently, for Windows users, whenever they use Codex with any new folder (workspace), they will be greeted with the sandbox setup screen and have to choose between default sandbox, non-admin sandbox or quit.
<img width="1330" height="252" alt="Image" src="https://github.com/user-attachments/assets/d5556fe2-f283-40b3-ac66-c95f02d8cffa" />
We would like another "no sandbox" option where user explicitly approves/denies commands.
Additional information
The default sandbox is not allowed by IT (due to concerns documented in https://github.com/openai/codex/issues/12343 and elsewhere), while non-admin sandbox carries significant risk and allows running arbitrary command without approval in our testing.
We do notice that if user chooses "quit" and immediate open codex again for the same folder, they can use Codex in a mode where they explicitly approve/deny any potentially risky command. There is no sandbox being applied in this mode.
Could Codex make this "no sandbox" mode an explicit choice in that screen?
5 Comments
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
not a duplicate
Using Codex without any form of sandboxing is highly discouraged. It's not safe, so it's not an option that we want to make readily available. The "no sandbox" mode is recommended only if you have your own sandbox in place (e.g. a container or VM).
Thanks for your reply. Just in case there is any confusion -- here the behavior is that user manually approves/denies any risky action, which is already there as an existing mode, just not exposed. This is also consistent with the default behavior of other coding agents in our survey (at least Claude Code and Gemini CLI)
The current "unelevated sandbox" carries more risk than manual approval workflow in our opinion -- we can easily come up with examples where a command that writes outside the current workspace folder runs without approval.
This feature request hasn't received enough upvotes, so it is being closed automatically. If you still feel this feature is needed, please open a new feature request with an updated title and description.