Windows sandbox failed spawn setup refresh OS error 740

Resolved 💬 10 comments Opened May 31, 2026 by TheB1ak3 Closed Jun 12, 2026

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of the Codex App are you using (From “About Codex” dialog)?

26.521.10419

What subscription do you have?

Pro

What platform is your computer?

OS: Windows 11 Home 25H2, build 26200.8457, x64

What issue are you seeing?

Codex Desktop Windows Computer Use failed with:

windows sandbox failed: spawn setup refresh
stdout_eof
OS error 740: The requested operation requires elevation

Findings:

Failure occurred while spawning codex-windows-sandbox-setup.exe.
Running Codex as Administrator did not fix it.
Helper executable could run manually from elevated PowerShell, but required a payload argument.
SHA256 matched the packaged helper.
No requireAdministrator manifest found.
No AppCompatFlags RUNASADMIN entry existed.
Adding AppCompatFlags RUNASINVOKER for the helper path made Computer Use work.

Possible cause:
Windows UAC installer/elevation behavior during CreateProcessW for codex-windows-sandbox-setup.exe.

What steps can reproduce the bug?

Open Codex Desktop on Windows.
Start a Codex session.
Grant or request Computer Use access.
Ask Codex to inspect the screen, for example: "Can you see my screen?"
Computer Use fails during startup.

Observed error:
windows sandbox failed: spawn setup refresh
stdout_eof
OS error 740: The requested operation requires elevation

Running Codex Desktop as Administrator did not fix the issue.

Running the helper manually from elevated PowerShell showed that the executable can start, but it requires a payload argument:
helper_request_args_failed: expected payload argument

Applying RUNASINVOKER through AppCompatFlags Layers to the helper executable path made Computer Use start working.

Feedback ID: 019e7c04-9994-7722-93cd-e1d7d9b6edf8

What is the expected behavior?

Computer Use should initialize successfully after the user grants access. Codex should be able to start its Windows sandbox/helper process and inspect targetable windows without requiring a manual AppCompatFlags workaround.

Additional information

The failure appears to happen during process creation before the helper process fully starts.

Codex diagnostics indicated that the parent process attempted to spawn codex-windows-sandbox-setup.exe and Windows returned OS error 740.

Additional findings:

The helper binary was not corrupted.
The AppData helper and packaged WindowsApps helper had matching SHA256 hashes.
No embedded requireAdministrator manifest was found.
No existing RUNASADMIN AppCompatFlags entry was present for the helper.
Adding RUNASINVOKER for the helper executable path made Computer Use work.
I did not include session logs because the session contains private project/workspace details.
Environment: Windows 11 Home 25H2, build 26200.8457, x64.
Doctor was clean

View original on GitHub ↗

10 Comments

github-actions[bot] contributor · 1 month ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#24926
#24050
#24755
#25226
#25357

Powered by Codex Action

TheB1ak3 · 1 month ago

This appears to be the same root cause as #24050, but reproduced through Codex Desktop Computer Use. My workaround was AppCompatFlags RUNASINVOKER instead of modifying the binary manifest.

jiabaoy777-arch · 1 month ago

I can reproduce this issue on Codex Desktop for Windows.

Environment:

Codex Desktop app version: 26.527.3686.0
Platform: Windows x64
Computer Use plugin version: 26.527.31326

Observed behavior:

Computer Use cannot initialize.
The first lightweight list_apps() check fails immediately.
Restarting the Codex app and restarting Windows did not resolve the issue.
Normal shell/file operations still work; the failure is specific to the Node REPL / Computer Use startup path.

Observed diagnostic output:

windows sandbox failed: spawn setup refresh
stdout_eof

The sandbox log shows the underlying failure while starting the AppData helper copy:

setup refresh: failed to spawn ...\\codex-windows-sandbox-setup.exe: The requested operation requires elevation. (os error 740)

I also verified that the helper executable exists. The AppData helper copy and packaged WindowsApps helper have matching file size and timestamp. This appears consistent with the Windows UAC installer-detection / missing explicit asInvoker manifest diagnosis described in this issue.

For privacy, I am not attaching the full sandbox log because it includes local workspace paths.

tjmbradybot-eng · 1 month ago

Codex version: 26.527.3686.0
Windows 11

Symptoms:

node_repl kernel exited unexpectedly
windows sandbox failed: spawn setup refresh
os error 740
Admin Sandbox setup fails
Backup Sandbox setup fails

Verified:

Windows Sandbox enabled
vmcompute running
Virtualization enabled
Chrome extension connected
Native host manifest valid
codex-windows-sandbox-setup.exe launches manually
Browser plugin enabled
js_repl enabled

Issue persists after:

Reinstalling extension
Rebuilding plugin cache
Rebuilding Codex runtime cache
Enabling Windows Sandbox
Rebooting

silverleafsolutions · 1 month ago

I'm experiencing the same issues with Codex for Windows, now v26.602.30954 also, where many commands run by Codex suddenly start triggering lots of UAC popups, specifically rg for some reason. I had it record logs that it saved with Feedback ID 019e8a3c-336f-78d1-b991-8b6576f51d30, if that helps someone who has access to that data.

The UAC screenshots always show some kind of file requesting access like this:

Verified publisher: OpenAI
Path: C:\Program Files\WindowsApps\OpenAI.Codex_...\resources\codex-windows-sandbox-setup.exe

YusukeONOZAKI · 1 month ago

Additional data point from another Windows 11 Home 25H2 machine.

Environment:

Codex Desktop app version: 26.602.3474.0
Windows 11 Home 25H2, build 26200.8524
AMD-V enabled in BIOS/UEFI
Windows Hypervisor Platform enabled
Virtual Machine Platform enabled
McAfee uninstalled
Rebooted after each major change

Observed behavior:

node_repl still fails before any JS executes.
Minimal test result:
node_repl kernel exited unexpectedly
windows sandbox failed: spawn setup refresh
reason: stdout_eof
Chrome extension / native host side appears healthy.
Browser-side WebSocket connectivity is also healthy:
Chrome DevTools shows wss://ws.chatgpt.com/...
Status 101 Switching Protocols
so this does not appear to be a browser network / WebSocket block.

Relevant local app log evidence from the same machine:

Browser Use availability resolves as available on Windows.
Computer Use native pipe reaches startup ready.
Codex selects the bundled node_repl.exe path.
Failure still occurs after that point, which makes this look like a Windows sandbox / helper / node_repl startup problem rather than a Chrome extension problem.

I also tested the commonly suggested workaround of changing:

[windows]
sandbox = "elevated"

to:

[windows]
sandbox = "unelevated"

On this machine, before re-testing the full Desktop flow after restart, the bundled CLI path already showed another Windows sandbox failure when forced to unelevated mode:

codex -c windows.sandbox="unelevated" sandbox windows cmd /c echo CODEX_UNELEVATED_SANDBOX_TEST_OK

Observed result:

windows sandbox failed: CreateRestrictedToken failed: 87

So this may be a related but slightly different Windows sandbox failure path on Home 25H2, where unelevated is not an immediate clean workaround.

ricwoodard · 1 month ago

Another affected Windows Codex Desktop user with the same windows sandbox failed: spawn setup refresh failure.

Environment/evidence, redacted:

Codex Desktop package observed in sandbox logs: OpenAI.Codex_26.602.4764.0_x64__2p2nqsd0c76g0
Command runner observed: codex-command-runner-0.137.0-alpha.4.exe
Affected features: both Chrome control and Computer Use fail because node_repl exits before running JS.
The user has restarted Codex several times and repaired/reinstalled the Chrome plugin; failure persists.
Chrome extension UI shows connected, and Codex shows Chrome connected.
Chrome native host manifest exists at the expected user-local path, redacted:

C:\Users\<user>\AppData\Local\OpenAI\extension\com.openai.codexextension.json

Inside Codex shell, the effective identity is the sandbox account, while profile env vars point to the real user profile:
whoami = <domain>\codexsandboxoffline
USERPROFILE = C:\Users\<user>
LOCALAPPDATA = C:\Users\<user>\AppData\Local
From the sandbox identity, the expected native host registry key is not visible under HKCU:

HKCU\Software\Google\Chrome\NativeMessagingHosts\com.openai.codexextension

Chrome process check fails from the sandbox with access denied:

tasklist /fo csv /nh /fi imagename eq chrome.exe -> ERROR: Access denied

Node/bridge symptom:

node_repl kernel exited unexpectedly
node_repl diagnostics: {"kernel_status":"running","kernel_stderr_tail":"windows sandbox failed: spawn setup refresh","reason":"stdout_eof","stream_error":null}

Relevant sandbox log excerpt, redacted:

setup refresh: spawning C:\Users\<user>\AppData\Local\OpenAI\Codex\bin\fb2111b91430cb17\codex-windows-sandbox-setup.exe (...)
setup refresh: failed to spawn C:\Users\<user>\AppData\Local\OpenAI\Codex\bin\fb2111b91430cb17\codex-windows-sandbox-setup.exe: The requested operation requires elevation. (os error 740)

Later attempts also show the packaged helper path spawning/completing from the WindowsApps package path, but Chrome/Computer Use still fail through node_repl with the same spawn setup refresh message.

This appears to be the same elevation/setup-refresh issue, with an additional visible symptom that the sandbox identity/profile-registry mismatch prevents Chrome native-host and Chrome process/profile checks from working.

ryancom16 · 1 month ago

Adding a cross-reference to a more complete confirmation/prompt: https://github.com/openai/codex/issues/25419#issuecomment-4639724031

Summary: on Codex Desktop OpenAI.Codex_26.602.4764.0_x64__2p2nqsd0c76g0 with [windows] sandbox = "elevated", the AppData codex-windows-sandbox-setup.exe path failed with os error 740. Adding a per-user AppCompat RUNASINVOKER entry for the exact failing helper path restored node_repl, the in-app Browser, and the Chrome extension backend without switching to unelevated or no-sandbox.

Important caveat: the registry override is keyed by exact executable path, so if a Codex update changes the helper hash/path it may need to be applied to the new path. The linked comment includes a pasteable Codex prompt that diagnoses the condition first and asks for explicit approval before making any registry change.

lee62839459595929-blip · 1 month ago

I’m seeing a related Windows Computer Use failure on Codex Desktop.

Environment:

Codex Desktop: 26.602.4764.0
Bundled Computer Use plugin: 26.602.40724
Windows user profile: C:\Users\Administrator

Initial failure:

Computer Use failed with:

windows sandbox failed: spawn setup refresh
stdout_eof

Sandbox log showed:

setup refresh: failed to spawn C:\Users\Administrator\AppData\Local\OpenAI\Codex\bin\fb2111b91430cb17\codex-windows-sandbox-setup.exe
os error 740

Workaround applied:

Added AppCompatFlags RUNASINVOKER for:

C:\Users\Administrator\AppData\Local\OpenAI\Codex\bin\fb2111b91430cb17\codex-windows-sandbox-setup.exe

After that, os error 740 disappeared.
Sandbox setup now completes successfully:

setup refresh: processed 1 write roots (read roots delegated); errors=[]
setup binary completed

Remaining failure:

Computer Use still fails with:

Computer Use native pipe path is unavailable

Desktop logs show:

computer-use notify config ensure finished platform=win32 reason=missing-helper-path status=skipped
computer-use native pipe startup failed errorMessage="Windows Computer Use helper paths are unavailable"
computer_use_native_pipe_thread_config_skipped platform=win32 reason=not-ready

Additional check:

The plugin cache originally only had:

C:\Users\Administrator\.codex\plugins\cache\openai-bundled\computer-use\26.602.40724

I created a junction:

C:\Users\Administrator\.codex\plugins\cache\openai-bundled\computer-use\latest -> 26.602.40724

After restarting Codex, this path exists:

C:\Users\Administrator\.codex\plugins\cache\openai-bundled\computer-use\latest\node_modules\@oai\sky\bin\windows\codex-computer-use.exe

But the desktop app still reports missing-helper-path and does not start the Computer Use native pipe.

So RUNASINVOKER fixes the 740 part, but the app still cannot resolve/start the Computer Use helper paths afterward.

iceweasel-oai contributor · 1 month ago

this is now fixed