Windows sandbox fails all read operations with "apply deny-read ACLs" after power outage

Open 💬 6 comments Opened Jun 15, 2026 by romansydiuk-dev

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.609.41114

What subscription do you have?

Plus

What platform is your computer?

Windows 11 x64

What issue are you seeing?

After a power outage during an active Codex task, all file read operations started failing.

Codex can create files and write to them, but cannot read files or even list the current directory.

The following commands fail:

pwd
Get-ChildItem .
Get-Content .\hello.txt
Get-Content C:\Users\advok\Documents\test\test.txt

Node.js also fails:

fs.readFile(...)

Error:

windows sandbox: helper_unknown_error: apply deny-read ACLs

The error occurs before file contents are read.

I already:

Reinstalled Codex
Created new projects
Enabled Full Access
Enabled Default Permissions
Ran sfc /scannow (found and repaired corrupted Windows files)
Ran DISM /Online /Cleanup-Image /RestoreHealth successfully
Rebooted multiple times

The issue persists.

What steps can reproduce the bug?

Feedback ID: 019ec94e-896f-73d3-9fe8-9f8620e51be6

Create a new project.
Create hello.txt.
Write HELLO into hello.txt.
Run:

pwd

Run:

Get-ChildItem .

Run:

Get-Content .\hello.txt

Expected:
The file contents should be displayed.

Actual:
All read operations fail with:

windows sandbox: helper_unknown_error: apply deny-read ACLs

Feedback ID:
019ec94e-896f-73d3-9fe8-9f8620e51be6

What is the expected behavior?

_No response_

Additional information

_No response_

View original on GitHub ↗

6 Comments

github-actions[bot] contributor · 1 month ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#27672
#27889

Powered by Codex Action

romansydiuk-dev · 1 month ago

This may be related to issue #27889.

Both issues appear to fail during Windows ACL operations.

My sandbox starts, but any read operation fails:

pwd
Get-ChildItem .
Get-Content .\hello.txt

All return:

windows sandbox: helper_unknown_error: apply deny-read ACLs

Unlike #27889, I do not use elevated sandbox mode and the issue started immediately after a power outage during an active Codex task.

romansydiuk-dev · 1 month ago

After a power outage the issue persists across:

Codex reinstall
New projects
Full Access enabled
Windows SFC repair
DISM RestoreHealth
Multiple reboots

The sandbox cannot even execute:

pwd
Get-ChildItem .

Every operation fails with:

windows sandbox: helper_unknown_error: apply deny-read ACLs

coro-bot · 1 month ago

I experienced this myself after a system crash while using vscode+codex
Symptoms:
<setup_error.json>

{
  "code": "helper_unknown_error",
  "message": "apply deny-read ACLs"
}

<sandbox{date}.log>

Caused by:
    0: parse deny-read ACL state C:\Users\{user}\.codex\.sandbox\deny_read_acl_state.json

I reviewed deny_read_acl_state.json and the file was empty filled with NULLs and malformed.
This points to the implementation of the sandbox not validating the ACL config files upon initialization and remedying the issue by rebuilding if it is malformed or missing. This shouldn't persist through resets and reinstalls.

Easy fix: delete .codex/.sandbox/deny_read_acl_state.json

chalkplum · 10 days ago

can confirm on windows 10 started getting the same error: apply deny-read ACLs

deleting file at: $HOME\.codex\.sandbox\deny_read_acl_state.json

resolved the issue

romansydiuk-dev · 9 days ago

Thank you so much! This fixed the issue completely.
I had been struggling with this for over a month and tried reinstalling Codex, SFC, DISM, changing permissions, and everything else.

Deleting deny_read_acl_state.json immediately resolved it.

Really appreciate you taking the time to investigate this and share the fix!