›_ Codex Issues
Codex Issues / #21455

Windows Sandbox / Temporary Profile Leak with Codex Sandbox Users

Resolved 💬 2 comments Opened May 7, 2026 by motyc Closed Jun 15, 2026
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of the IDE extension are you using?

Cursor

What subscription do you have?

26.429.30905

Which IDE are you using?

Cursor

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Windows Sandbox / Temporary Profile Leak with Codex Sandbox Users

Summary

Codex on Windows appears to repeatedly create temporary Windows profiles (TEMP.<user>.*) during sandbox initialization or refresh operations.

In my environment this resulted in ~170 leaked temporary user profile directories under:

C:\Users\TEMP.David-PC.*

The issue appears related to the native Windows sandbox implementation and/or sandbox user management.

Observed components involved:

  • codex-windows-sandbox-setup.exe
  • codex-command-runner-0.128.0-alpha.1.exe
  • CodexSandboxOffline
  • CodexSandboxOnline

This does not appear to be malware. The generated files are Windows DPAPI blobs and profile scaffolding.

The issue appears to be:

  • sandbox/user bootstrap retry loops
  • temporary profile fallback
  • profile unload/cleanup failure
  • or repeated failed noninteractive logons.

---

Environment

  • Windows 11
  • Native Windows sandbox mode (not WSL)
  • Cursor extension using Codex
  • Observed with:
  • codex-command-runner-0.128.0-alpha.1.exe

---

Symptoms

Hundreds of directories created under:

C:\Users\

Examples:

TEMP.David-PC
TEMP.David-PC.000
TEMP.David-PC.001
...
TEMP.David-PC.169

Characteristics:

  • all directories contain nearly identical minimal contents
  • not full normal user profiles
  • timestamps appear in bursts
  • creation continues while Codex sandbox processes are active
  • creation stops after Codex processes are terminated

Example timing bursts:

  • 2026-04-29 22:30–23:30
  • 2026-05-01 02:00–03:00
  • 2026-05-06 16:00–18:00
  • 2026-05-07 01:00–02:30

---

Additional Observed Files

Each temp profile contains:

AppData\Local\Microsoft\Windows\SFAP\cache1.bin

Inspection of cache1.bin shows:

  • standard Microsoft DPAPI header
  • encrypted Windows credential/security blob
  • not executable content
  • not malware

DPAPI signature:

D0 8C 9D DF 01 15 D1 11 8C 7A 00 C0 4F C2 97 EB

This suggests the sandbox/user initialization path triggers:

  • LSASS
  • DPAPI
  • User Profile Service
  • SFAP cache initialization

---

Relevant Sandbox Log Entries

Observed in sandbox.log:

ensuring sandbox users offline=CodexSandboxOffline online=CodexSandboxOnline
setup refresh: spawning ... codex-windows-sandbox-setup.exe
helper launch
runner launch
command-runner
hide users: profile dir hidden for current user

The repeated setup refresh operations appear correlated with the temp profile creation bursts.

---

Important Observation

The log line:

hide users: profile dir hidden for current user

combined with existing Codex Windows sandbox issues suggests the implementation is manipulating:

  • Windows local users
  • profile directories
  • ACLs
  • hidden profile state
  • or Explorer visibility

This appears related to:

  • Windows sandbox user bootstrapping
  • first-logon profile initialization
  • or profile visibility suppression

---

Request

Please investigate:

  • sandbox user initialization
  • temporary profile fallback handling
  • profile cleanup/unload
  • repeated setup refresh behavior
  • hide_users.rs
  • interaction with Windows User Profile Service

The current behavior can silently generate hundreds of leaked temp profiles on Windows systems.

What steps can reproduce the bug?

Suspected Root Cause

My current hypothesis:

  1. Codex sandbox refresh runs
  2. Sandbox users are initialized or refreshed
  3. Windows attempts transient/noninteractive logon
  4. User Profile Service partially initializes a profile
  5. Profile attach/unload/setup fails
  6. Windows falls back to TEMP.<user>
  7. Cleanup does not occur
  8. Retry loop creates another temp profile

Possibly related APIs/components:

  • CreateProcessWithLogonW
  • CreateProcessAsUserW
  • S4U logons
  • User Profile Service
  • LSASS
  • DPAPI
  • sandbox ACL setup
  • hidden sandbox user profile handling

---

Repro Notes

Issue appears easiest to trigger when:

  • using native Windows sandbox mode
  • using Cursor/OpenAI Codex integration
  • long-running agent/sandbox sessions
  • repeated sandbox refreshes
  • elevated/native Windows sandbox mode

---

Mitigation

Temporary mitigation:

  1. Fully exit Cursor/Codex
  2. Kill:
  • codex.exe
  • codex-command-runner.exe
  • codex-windows-sandbox-setup.exe
  • node.exe
  1. Reboot

After this:

  • new TEMP profiles stopped appearing

What is the expected behavior?

Codex not creating leaked profiles

Additional information

_No response_

View original on GitHub ↗

2 Comments

github-actions[bot] contributor · 3 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #21208

Powered by Codex Action

motyc · 2 months ago

Verified root cause of the temp-profile leak (C:\Users\TEMP*). The elevated Windows sandbox ([windows].sandbox = "elevated") runs commands as the bootstrapped CodexSandboxOffline / CodexSandboxOnline users. When pwsh.exe resolves to the Microsoft Store / WindowsApps App Execution Alias (a 0-byte reparse point under %LOCALAPPDATA%\Microsoft\WindowsApps\pwsh.exe), that alias is ACL-granted to the interactive user but not to the sandbox users. The sandbox launch then fails with CreateProcessAsUserW failed: 5, surfaces as windows sandbox: spawn setup refresh, and retries; each retry drives a noninteractive logon that Windows satisfies with a TEMP.<user>.NNN profile fallback plus an SFAP/DPAPI cache1.bin, producing the leak. This is sandbox-implementation behavior, not a temp-path gap.

Workstation remediation (user scope, not repository config). Remove the Microsoft Store PowerShell and install pwsh via scoop or the MSI/WiX package, making PATH precedence deterministic so the real interpreter resolves before the WindowsApps alias (the MSI is being deprecated, so scoop is the durable path). OpenAI maintainers additionally recommend the unelevated Windows sandbox as equivalent for nearly all use cases. These are user-level fixes; the repository neither writes them nor depends on them, and automatic sandbox-mode switching remains a non-goal.