Codex VS Code extension writes files without approval despite read-only/on-request config on Windows

What version of the IDE extension are you using?

26.429.30905

What subscription do you have?

Business

Which IDE are you using?

VSCode

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Out-of-the-box, Codex is not asking for permission before making file edits. Modifying the config.toml file to control permissions results in 'unable to start admin sandbox'.

What steps can reproduce the bug?

See notes above. I was working through the analysis of a bug, and codex began to modify a code file in multiple steps without any permission. I have shut it down as I do not trust that it will not end up doing something more destructive to my codebase.

What is the expected behavior?

Permissions should always be granted by the user. It should never be up to the user to revoke assumed permissions. Trust is earned. And this just blew it big-time. Not sure I will come back to it as I cannot trust that the permissions structure I have in place is going to hold.

Was comparing with Claude's coding agent which is a darned sight better behaved.

Additional information

_No response_