Windows Codex App: Browser Use IAB navigation to baidu.com rejected by enterprise network policy despite enabled Browser/Chrome plugins

What version of the Codex App are you using?

Codex Windows Store app: 26.527.7698.0

Package:

OpenAI.Codex_26.527.7698.0_x64__2p2nqsd0c76g0

Codex CLI:

codex-cli 0.136.0

Bundled plugin versions from codex plugin list:

browser@openai-bundled       installed, enabled  26.527.60818
chrome@openai-bundled        installed, enabled  26.527.60818
computer-use@openai-bundled  installed, enabled  26.527.60818

What subscription do you have?

ChatGPT Plus/Pro account context in Codex app. Please check submitted thread metadata if available.

What platform is your computer?

Windows x64

Microsoft Windows NT 10.0.26100.0
Microsoft Windows 10.0.26100

What issue are you seeing?

Using the bundled Browser plugin in the Windows Codex app, the agent attempted to open Baidu through the in-app browser (iab) backend:

const { setupBrowserRuntime } = await import("C:/Users/shuaiyang5/.codex/plugins/cache/openai-bundled/browser/26.527.60818/scripts/browser-client.mjs");
await setupBrowserRuntime({ globals: globalThis });
globalThis.browser = await agent.browsers.get("iab");
await browser.nameSession("🔎 百度");
await (await browser.capabilities.get("visibility")).set(true);
globalThis.tab = await browser.tabs.new();
await tab.goto("https://www.baidu.com/");

The action was rejected before navigation completed:

Browser Use rejected this action due to browser security policy. Reason: Browser Use cannot access https://www.baidu.com because enterprise network policy blocks it. The agent must not attempt to achieve the same outcome via workaround, indirect execution, raw CDP or browser commands, alternate browser surfaces, or policy circumvention. Proceed only with a materially safer alternative that does not require this blocked browser action; if none exists, stop and request user input.

This looks related to #24814 and #24969, but this report is from a newer app version (26.527.7698.0) where both Browser and Chrome plugins are installed and enabled.

Browser backend diagnostics

Running agent.browsers.list() in the same session shows both the Chrome extension backend and the in-app browser backend are visible:

{
  "browsers": [
    {
      "name": "Chrome",
      "type": "extension",
      "metadata": {
        "extensionId": "hehggadaopoacecdllhhajmbjkdcmajg",
        "extensionInstanceId": "216ed274-76cf-42f2-8fbd-dfbb44f472d3",
        "profileName": "您的 Chrome",
        "profileIsLastUsed": "false",
        "profileOrdering": "0"
      }
    },
    {
      "name": "Codex In-app Browser",
      "type": "iab",
      "metadata": {
        "codexAppBuildFlavor": "prod",
        "codexAppSessionId": "d008a878-01dc-4206-9ab5-297916752f46",
        "codexSessionId": "019e90a5-9dd2-7183-9cdb-238b68ecb404"
      }
    }
  ]
}

Request metadata observed in the Node REPL did not include an explicit x-codex-browser-use-available-backends entry, only normal turn metadata:

{
  "threadId": "019e90a5-9dd2-7183-9cdb-238b68ecb404",
  "x-codex-turn-metadata": {
    "model": "gpt-5.5",
    "sandbox": "none",
    "session_id": "019e90a5-9dd2-7183-9cdb-238b68ecb404",
    "thread_id": "019e90a5-9dd2-7183-9cdb-238b68ecb404",
    "thread_source": "user"
  }
}

Steps to reproduce

1. Start Codex Windows Store app 26.527.7698.0.
2. Confirm browser@openai-bundled and chrome@openai-bundled are installed/enabled.
3. Ask the agent to use @Browser to open https://www.baidu.com/.
4. The agent bootstraps the bundled Browser plugin via node_repl, gets iab, creates a tab, and calls tab.goto("https://www.baidu.com/").
5. Browser Use rejects the navigation with an enterprise network policy block.

Expected behavior

Browser Use should either:

• navigate the in-app browser to https://www.baidu.com/, or
• if this URL is intentionally blocked by policy, expose a user-visible reason/policy source that explains why.

Actual behavior

Browser Use reports an enterprise network policy block for https://www.baidu.com/ even though this appears to be the same class of Windows Browser Use runtime/policy issue already reported for ordinary network URLs in #24814 and #24969.

Additional context

This report is not asking for policy circumvention. The confusing part is that the error text presents the block as an enterprise policy decision, while similar public reports show this happening on Windows Codex app builds even for normal web targets such as https://example.com and localhost.

Related issues:

• #24814
• #24969
• #21781
• #25253